Personally mine are the fact that this isn't really "zero trust", but more "infinitely diffuse trust" where every user has to trust every application. None of the packaging alternatives I'm aware of seem to yet have their security story in line where they are either secure enough (without breaking most software) to not have to trust every application or provide some level of assurance themselves comparable to the debian maintainers.