The authority isn't trustworthy though. They're a direct conduit to malware. That's the point here.

And try not to conflate walled gardens with software repositories. The benefits of the latter are available without the wall. The wall is significant because it stops you making your own trust judgements.