Even if there are easy tools available, I'd still need to learn them for each distro I want to support. Heck, just figuring out the different names each distro uses for a particular package is a fair bit of work.
Smart distros keep things close to upstream so the burden is small.
This is a weird argument.
Now you want each developer to manage dependency updates for their application? I don't trust them to develop their own app let alone apply security patches properly.