It’s not a security issue given your old system wasn’t compromised. I don’t know enough about how flatpak tracks whether a runtime is already downloaded. If copying works, please come back and comment that it works.
If you’ve used flatpak --user, apps and runtimes are also in ~/.local/lib/flatpak that need to be copied.