It also gives them the ability to override any package on your system with one they make. All they'd have to do is increase their version number beyond the one

It also gives them the ability to override any package on your system with one they make. All they'd have to do is increase their version number beyond the one in the "real" repositories and Apt would automatically update to it by default. So yes, in fact, it's quite true.