If you think about it, package repositories are just like app stores. They're curated, centralized places to obtain software where you can have high confidence it's free of malware.

...And it's free software with no arbitrary usage restrictions. Meaning you can actually audit it if you so desire, and in fact you'll be doing a great service to users and developers in the process.