This is kind of my view. Some are definitely operated by smart people e.g. Ondřej Surý offers his PHP packages for Ubuntu via a PPA (and via a regular apt repo

This is kind of my view. Some are definitely operated by smart people e.g. Ondřej Surý offers his PHP packages for Ubuntu via a PPA (and via a regular apt repo for Debian). As for the packages: they're literally just regular .deb packages, which means they're installed as root, which means yes they could do anything. Of course you can also examine/extract them just like with a regular repo, but it's definitely an issue of trust for most people. I trust that e.g the Varnish project, or Percona or the aforementioned Ondřej Surý are not putting shifty shit in their packages. I can't trust JimmyB on Launchpad the same way.