> Maintainers working on a "distribution" have a responsibility to make the whole distribution of software work well & stably together, and they generally do so quite well with the odd slip up (I'm looking in the direction of the debian-openssl screwup).

Is there a policy that requires Debian package maintainers to seek mentorship of upstream when patching core packages?

I understand your point about maintained packages. But it's only a significant advantage if the maintainer's decisions must be filtered through the lens of the software maintainers. Otherwise one must trade the narrow expertise of the software maintainer for the wider expertise of the package maintainer.

That doesn't seem like a wise tradeoff IMO, and I don't see how a future openssl debacle could be prevented otherwise.