I think DigitalOcean would support this better than Linode. You could keep the build host filesystem on a block storage volume instead of having to recreate it every time, and you could store the built packages in DigitalOcean's equivalent of S3 instead of needing a VPS just to host them.

I don't know about it being better, but you've got me curious. Linode also has block storage volumes. On using something like an S3, I wonder if that's really the best option. I don't know if it's cheaper, but it seems to be less flexible. For example, I like to have my private package repo provided on a VPN, not open to the public. I don't suppose using something akin to S3 would allow for a similar setup.

But really, what's your threat model? For a VPS employee/company to mess with your packages, they'd have to be personally targeting you. If you're only worried about systematic, automated handling of all company VPS to insert malware in the ones that have package repositories, then you can probably set it up in an unusual way to evade such a program.

I think chances are pretty slim that a VPS company's vps isolation is so crappy that you have the chances of getting your vps hardware shared with someone that knows of such a gapping security hole that could be such a huge liability to the VPS company.

EDIT: Also, why would someone go out of their way to compromise a neighboring VPS, check if they, by chance, have a package repository, and insert malware in that? Who are you, that someone would think that's a good use of their time?

You know, society can't function without trust. Every person that's close to you could suddenly turn around and try to kill you, but you have to trust that they function by reason, and know that they have no reason for doing so. Locks around the world are pretty useless to keep strangers from lock-picking them and very many of them are keyed-alike. Their real reason is to simply make it a greater hassle to get to whatever they're protecting and therefore make it a less appealing target. Like so and with other methods, people implement their security by making themselves a less appealing target. Some people setup the outside of their home as a dump while building a mansion inside. These people trust robbers to act on reason.

No one has perfect security. Security is a matter of choosing what to defend against (your threat model), choosing what you can trust, and anchoring your defenses on the things you trust.

EDIT 2: I removed the paragraph on VPSes being virtual in name only. Linode apparently uses KVM.