By that logic MacOS doesn’t have any third party software at all.

No, it means that macOS and its third party software aren't one in the same thing.

Is faker.js a macOS vulnerability because there were people using Macs who installed npm and then installed faker.js? This isn't a theoretical question—whenever you install something, you need to consider where it's coming from and whether they can be trusted.

MacOS has third party software.

MacOS has homebrew as an open source package manager.

It has a third party package manager, yes. I'm pretty sure your parent meant that there isn't a first party one.

On Debian, packages in the official repositories are considered to be literally part of the Debian project. The maintainers are considered Debian maintainers, and bugs go into the Debian bug tracker.

This matters due to the trust issues I alluded to above. It also means that on Debian, there is one definitive version of Python (or at least one per Python version). The Homebrew, MacPorts, and Python.org Python binaries are all slightly different, such that it's possible for software to work with one but not the other.

No two Linux package managers are identical either, and not all Linux distributions work like Debian. Debian is a collection of volunteers. The choice to trust it is no different to the choice to trust Homebrew. Considering the package manager to be part of Debian doesn’t change this.

However none of this has any relevance to the claim in question, which is that python must be installed manually.

MacOS certainly has a package manager that can install and maintain python.