I only think this applies to certain ecosystems (ones where the motivation or incentive to provide the software doesn't align with ensuring user's safety or security).

The native apps I run on my Linux laptop, for example, I trust quite a bit. There may be a way for someone to sneak in some obfuscated code that does some harm, but I think the risks are much lower than many of the alternatives.