Other people could build these apps at build farm and publish under trusted vendor name like linux distributions do. You don’t trust vim.deb from anyone, but e.g. vim.org and ftp.??.debian.org/debian have at least strictly no intent to abuse you.