Comment by openmapsguy

I’m sure what you’re saying happens. There’s 1000s of packages with maintainers of varying skill.

That said the track record speaks for itself. I can only remember one time a maintainer introduced a vuln in Debian. The system works even though you’ll find cracks if you look.