While this is true, in practice it's more secure than you'd see on most operating systems. The reason being that the software is typically from a centralized,

While this is true, in practice it's more secure than you'd see on most operating systems. The reason being that the software is typically from a centralized, trusted repo that has been vetted by maintainers. The software is typically OS and it's not the app developer who releases it to you, the customer. It's the maintainer who packages it and will even apply custom fixes to it. Yes, there's some trust here. But historically, there's very little examples of rogue Debian maintainers doing something naughty. Whereas on, say, the Play Store, the app dev distributes the App to you and the Play Store just does some preliminary black-box checks. They're not getting the code and packaging it like a debian maintainer would. Some distros, like Debian, even FORCE app devs to use the system provided libs - they can't statically link their own library code. So they're pinned to a particular version of openSSL, libc, wlroots, libpng, etc. This prevents a huge variety of supply chain attacks. You can't bundle a compromised version of any one of the libs. And lastly, in stable distros the software typically goes through many routes before landing on a customer device. For debian, you're looking at months of real-world usage in testing and unstable before you see the software. This finds out vulnerabilities - this is why, for example, debian stable never had to deal with the XZ vuln. This isn't true for direct-to-customer app stores.