I do not consider all 3rd party places as untrusted (this sort of thinking leads to walled gardens) and i'd put these under "downloading from trustworthy places" in the sense that they are more of a way to download something and less a source themselves (e.g. you can download a pip package from both a trustworthy developer and untrusted developer). Of course the more layers between you and whatever you want to download, the harder it becomes to judge things.

For example i'd trust an apt repository or pip package developed by -say- Blender developers, regardless of it being a 3rd party repository or delivered through pip.