Also, if a package installed a suid binary, I would still have no recourse nor ability to audit and it would have full root rights. And blanket warning about s

Also, if a package installed a suid binary, I would still have no recourse nor ability to audit and it would have full root rights. And blanket warning about such packages would lead to a slew of false positives and warning fatigue (heck, even ping needs to be suid root)