Windows-Noob: Security with repositories

Hey!

I work as an IT-Consultant in the Microsoft space, using MacOS on my personal device. So kinda the opposite of this sub.

The only real contact I had with Linux are the few "odd one out" VMs on Hyper-V Clusters I found at some customers, ofc the Minecraft/Game Server I have and some linux based ready-to-use software appliances.

I now tried to get more into Linux, read into the paradigms of .deb, .rpm based distributions and compile-first distros like Arch. And I like it.

I know have a question from a security standpoint, because the paradigm is completely different, than from what I know at windows. In a normal Windows environment, I download my software directly from the developer. I get Chrome from Google directly, I get .NET from Microsoft directly, I get 7zip from Igor Pavlov directly. Same for MacOS, I get my .dmg and .pkg files.
With Linux, I now have to trust a central repository. For me, a Windows plep, this looks like a single point of failure. I now have to trust an extra entity, to provide me with software. The direct connection to the developer/company behind my software is lost. It adds an extra party to my installation process.
Some companies also offer .deb/.rpm files on their website to download from, but kinda often, they still require libraries from repositories to work. So no all-in-one compiled version.

With Arch, I had some hopes that it would be different, but then I got disappointed rather quickly, when I learned, that a very big chunk of the ecosystem is built upon AUR. Now I just don't have to trust a repository provider, I now have to trust a single plep, I have no possibility to know nor build and trust towards.

So overall, extra attack vectors.

I really try to understand this topic. Do I get something wrong? I would love to get an explanation or hint on what I oversee here.