Are you sure you would've preferred the xz author to not have to jump through all the hoops they had to, and instead just press upload and boom everyone has it,

Are you sure you would've preferred the xz author to not have to jump through all the hoops they had to, and instead just press upload and boom everyone has it, like it has happened countless times in the node ecosystem? Maintainers are a first line of defense. They are users of the software just like us, and share the same interests. This means that most obvious misbehavior (not necessarily malware but just anything anti-user or just general bugginess) is caught before it has broader impacts. The fact xz made it into the news is because it was an anomaly, and even then its impact was reduced to only the unstable versions of debian and such. As for PPAs, you're right, adding a new repo means trusting a new set of maintainers. Thankfully only few software needs this so the amount you need to verify is relatively small.