arch itself had a similar reputation for half-assing security etc; package signing was a big sticking point back in the day this is a plausible consequence of

arch itself had a similar reputation for half-assing security etc; package signing was a big sticking point back in the day this is a plausible consequence of “whoa what if arch infra + polish/friendliness” turning out more popular than expected. you are no longer showing the world a proof of concept; you are now a vendor, like it or not. i'm sympathetic to the associated growing pains that said, it reinforces my belief that past a certain point, derivative distributions are just kind of uninteresting. if you are at the level where distros primarily distinguish themselves by the out-of-the-box desktop, then fair enough. if you're down here with me in the ninth circle of hell where they primarily distinguish themselves by their package manager, the response to “ok no wait guys so like, it's debian..... but it boots into enlightenment” is just “ugh”