There is a very big risk difference between a upstream package like XZ and running random application with brew or god forbid zsh auto update. >Do Linux users

There is a very big risk difference between a upstream package like XZ and running random application with brew or god forbid zsh auto update. >Do Linux users think about this? Yes that's why i avoid packages not in the official distro repositories and where possible further minimize risks by using additional security layer such as sandboxing (flatpak and firejail), mandatory access control (Apparmor or SELinux), virtualization (KVM/Qemu) and application firewalls (Opensnitch).