Maintainers may not perfectly vet projects, but they do vet the projects that get added at least a little. Compare that to a repository where anyone can upload

Maintainers may not perfectly vet projects, but they do vet the projects that get added at least a little. Compare that to a repository where anyone can upload and promote actual virus software. PPAs at least require the user to explicitly trust the source of packages. If a distro releases a package, that is a tad more trustworthy than a random PPA, because at least the distro maintainers (very experienced people) thought it was good enough and not a virus. The distinction between "official" and "unofficial" is not there when it comes to all those language-specific repos. Also, typo-squatting is not a thing with official Linux repos, because maintainers know to not let it happen.