Debian does everything in the open. You can download the source of a package and build it yourself, compare checksums, run diffs. Most packages have reproducibl

Debian does everything in the open. You can download the source of a package and build it yourself, compare checksums, run diffs. Most packages have reproducible builds so you can confirm what you're getting! Debian also doesn't require or use an "account" for downloads, and if they release a version of something, it's on the public mirrors that many people will be able to access. With Google the entire process is completely opaque, they do everything behind closed doors, and can hand different users different blobs on demand. Ultimately with Google, you only have Google's word for what they're doing, and you know they have the capability to provide different versions to different users on demand of an NSL. With Debian, they have no way to attack a specific user, and you fully have the ability to "check their work."