Sure, but it is centralised in the os distribution package manager, if you use helpers like yay. I am just pointing out that centralisation is not solution to the attack mentioned.