I just don't expect every developer to be an expert at packaging their app. There's a thousand things to think of, and they might do an unreasonable hack just t

I just don't expect every developer to be an expert at packaging their app. There's a thousand things to think of, and they might do an unreasonable hack just to get away with distribution. If you get your packages from a single source, you mostly have to trust that source (lower attack surface), and can be assured they will meet a minimum quality level. Example oopses from valve (but really, most vendors have theirs): https://github.com/ValveSoftware/steam-for-linux/issues/3671 https://github.com/ValveSoftware/steam-for-linux/issues/3671 https://amonitoring.ru/article/steamclient-0day/ https://amonitoring.ru/article/steamclient-0day/