You do raise some good points. However, what comes to mind as a relatively easy win with real gains for a large part of Linux desktops would be a global scanne

You do raise some good points. However, what comes to mind as a relatively easy win with real gains for a large part of Linux desktops would be a global scanner for hostile npm/pip/etc packages. To catch typosquatters, takeovers etc of dependencies. A lot can be inherited or borrowed from existing implementations.