Some things are like that but there is a decent amount of package managers now a days that at least pin package hashes so they'll fail if the package has been t

Some things are like that but there is a decent amount of package managers now a days that at least pin package hashes so they'll fail if the package has been tampered with. I'm not aware of many places that audit dependencies to a greater extent than "the license is compatible and it has reasonable maintenance". Pulling packages from the internet is fine and that's how all Linux distros work but the more important thing is signature verification, imo