The options for the 'confirm form' flag link type are technically required, in that leaving them blank and submitting the form makes the form fail submission.
However, they are not marked as #required in the form array, so the user doesn't know they were required until they see the error message.
The reason for this is that they are hidden, and only shown if you pick the link type they go with. So making them #required would mean that they'd be required even when hidden and irrelevant -- which would be a huge UI bug!
But now on D7 we can achieve this with states: we already toggle visibility based on the link type checkbox; we can do the same with the 'required' property.