If the attack happens on the developers repo, not even Linux repository packages would be safe at that point

I figured this is the type of attack you were referring to, but then you say you yourself don’t really live by that safety measure.

I don’t either. I don’t have enough time, patience, or knowledge to check the source of everything I install to see if it suddenly has malware. That’s where I draw my line in the security sand. 😅