Debian and Ubuntu's package managers want to attest that packages they install come from Debian/Ubuntu repositories, or from third-party repos the user trusts. Which is reasonable. You can install third-party software yourself, or compile your own binaries without signing anything, on those systems and they'll still run.

Operating systems with "signed binaries or GTFO" policies are not really protecting the user. Any protection the user receives is a secondary concern to the fact that the OS vendor wants to control what the user runs on the device.