It only goes through "apt the program", but apt is just serving as a method of installing a package, which is hosted on one of the configured apt sources.

Calling all software installed through apt "first party" is a wild stretch, since you can apply the same logic to git, wget, or a web browser. For instance, it would probably be correct to say that most Windows software is downloaded and installed through Chrome, but nobody in their right mind would claim Google owns the largest first party store for Windows.

So is Debian the first party? Or the clone hosted by a university near you? You probably had a mirror there, not Debian's own host. Because they used to be the slowest.