> Aren’t they very easy to exploit, for a mildly dedicated actor?

Debian does very extensive vetting of the contents of packages - and of the volunteers who get to become Debian Developers.