> The ones on linux operate on basically the same principle, with (usually) even less oversight. It's a public gallery that everybody can publish to, so the trust/distrust should be put on the package level, not the platform.

Just so you know, this is not true with any Linux distribution package manager that I know of. Packages and updates are always vetted by maintainers before they are available to user systems. Trust is intended to be at the distribution level; for Debian, for example, you can be confident that every package in the stable repository is fairly secure, tested software, and as long as you don't enable the non-free repo, every package is free and open source software as well.

This may or may not be true for Chocolatey, I don't know.