There's an element of curation - any rando can't just upload something to Debian, there's a web of trust. But mainly I think it's that repositories are invaria

There's an element of curation - any rando can't just upload something to Debian, there's a web of trust. But mainly I think it's that repositories are invariably built from source. Everything in a distro repository is open source software, guranteed to have been built from source from scratch. F-Droid does this, and its repositories are as clean as any Linux distro's as far as I can tell. (This is why Moxie's claim that F-Droid is somehow less secure than Google Play because it signs its own .apks is weapons-grade baloneyum. On Google Play, that .apk could have anything in it. On F-Droid, that signature is a guarantee that that app has been downloaded and built from public sources, just like any Linux distribution. If F-Droid allowed developers to sign their own apps, then F-Droid couldn't build the apps, unless every app supported reproducible builds.)