Distro package maintainers are not security researchers, they don't audit the code they maintain.

They do to some extent in the larger distros, but for proprietary/binary packages they don't have much chance anyway unless they are willing to do some pretty time-consuming forensics.

I do, and I work at a security company. But thanks for knowing more about my life than myself, random internet person.

This is false.

Plus the app developers at least have some level of accountability. Like when JWZ got into it with Debian (can't link here). You might think you are running XScreensaver from the great Zawinski, but no you are actually running some weird fork from godknowswho, hopefully not Jia Tan.