I just don't expect every developer to be an expert at packaging their app. There's a thousand things to think of, and they might do an unreasonable hack just to get away with distribution.

If you get your packages from a single source, you mostly have to trust that source (lower attack surface), and can be assured they will meet a minimum quality level.

Example oopses from valve (but really, most vendors have theirs):

https://github.com/ValveSoftware/steam-for-linux/issues/3671

https://amonitoring.ru/article/steamclient-0day/