Where does a distribution like Debian stand? Can the people who upload packages do something fishy and not get caught? Not that I doubt their intention, but let

Where does a distribution like Debian stand? Can the people who upload packages do something fishy and not get caught? Not that I doubt their intention, but let's assume a developer is forced to do it by say his state or through some other coercion?