Apart from what sibling said, another issue is explosion of trust assumptions. On my system, I obviously have to trust the Archlinux project not to serve me ma

Apart from what sibling said, another issue is explosion of trust assumptions. On my system, I obviously have to trust the Archlinux project not to serve me malware. When using Julia, I additionally have to trust the Julia project not to serve me malware. (See also: Python, Node, etc.) Obviously: less trust is better for security, ideally almost all installed software would be signed by Archlinux maintainers. For comparison, the situation is kind of similar for Apple users; but on Windows, trust is extremely watered-down anyway (with or without Julia or Python etc.).