RPMs / dpkgs require root to install to the machine-global database. Both package formats have mechanisms called "triggers" which allow the package to run arbit

RPMs / dpkgs require root to install to the machine-global database. Both package formats have mechanisms called "triggers" which allow the package to run arbitrary shell script at install or uninstall time. Since install/uninstall are run as root, this means arbitrary root code execution on install. Vs: a non-root user extracting a tgz and then running some file, root is never involved. I'm not in agreement with OP about this being a concern worth his or her mitigation strategy, but the logic is sound.