Which, people should never ever do either. Maybe as a SWE I'm too removed from other people's use cases but I cannot recall the last time I ran an executable on my computer that didn't go through a centralized inspection. Be it me myself, or Debian team etc...