Even using the official repos doesn’t guarantee you to be safe. The project developer might have had their development machine hacked and/or their source reposi

Even using the official repos doesn’t guarantee you to be safe. The project developer might have had their development machine hacked and/or their source repository hacked and malicious code inserted. So when Arch / Ubuntu / etc package maintainers pull the latest source, unless they’re doing very thorough diffs of each source file, they could easily miss the injected malicious code and subsequently repackage that for the distro. What has actually happened before. Also if your Linux / UNIX machine has an addressable WAN IP then you have all the usual risks of involved with hosting services on the public internet. A few years ago there was a spate of compromised web servers with the malware running as Apache modules. So there aren’t really any guarantees when running Linux.