This is kind of a sophism, of course it's not perfect (nothing is) but I'll still trust this model over Android or iOS which have a built-in advertising id, manufacturer modifications I can't even look at and shady processes which have more power than I do.

Security is also a social contract.

Yep, most house doors locks won’t survive a well placed kick, but in a safer community, that’s all people have. But in less trusting neighborhoods, everyone use steel bars on windows and have an additional steel door for every wooden one.

So you still can have bad actors in the package manager model, but something like Adobe who treat user agency with contempt is less likely to happen.

So I trust my distros and its maintainers more than I trust Apple. And Apple already have most of my data via iOS.