> That is the problem, though. It was never yours. It belonged to app developers, some of them potentially nefarious.

But it has been mine for decades and nefarious developers somehow weren't a real issue in my distro's repositories for this whole time. It's a self-inflicted problem.

Supply chain attacks have been an issue as long as you've relied on distributions. I can point to plenty examples in the wild, but you don't have wait for an incident to occur before creating a safer userspace.