But then why does the flagship allow its holodecks to create sentient holograms on-demand? Seems a bit of a security flaw.
Because flagship MUST have more adaptable programming. Just because it may be useful in some situations. The Federation flagships are usually long-range explorers with elite crews; they tended to stuck in troubled situations pretty often, and they need all resources that may help. Including the ability to create sentient AI's, if the situation demand that.