I also remember when I first started with Arch, which at that time had unsigned packages. Very much at the urging of Arch maintainers not to, people are using

I also remember when I first started with Arch, which at that time had unsigned packages. Very much at the urging of Arch maintainers not to, people are using package managers to install stuff from AUR, where literally anyone can upload PKGBUILDs. Another easy vector (for developers) are language package managers. E.g. Rust's Cargo runs build scripts (small Rust programs for configuration) for many crates, unsandboxed.