I don’t remember malware on Debian, Ubuntu, Fedora or Arch’s repository (put there by maintainers like the examples I gave above, or by a hack). And definitely not Gentoo.

But you are right. The bottom line is, you shouldn’t trust that which you cannot verify; but with open source, you have much more ability to verify (but it’s not a panacea - you run to many lines of code to verify yourself, it’s not clear anyone trustworthy verified it all, and there also the “reflections on trusting trust” argument)