Also, if you add random Debian packages they are also entitled to run arbitrary programs (as root!) while installing.

The only thing wrong about this title is that it does not read "https".