The problem is largely structural. Debian has huge repos and swaths of maintainers, and it works out because they read and audit source code to a degree. The end-result is that the Debian repos definitely have much less malware than either the play store or the Apple app store.

Apple does not audit source code, they do very simple behavioral analysis. And, evidently, even get that wrong, this post serving as an example.