I think security wise it got worse. With traditional package repos someone still does some due diligence. Also it's not clear what's going on, and that is a huge prerequisite for security.