distro repos: there is a process that is supposed to ensure no malicious changes make it through. Usually far enough behind recent code changes for new issues/code being compromised to be spotted
official package outside distro repos if packaging org has secure release workflow
building from source / official package on external repo if you know little about packaging org: malicious contributor or a compromised account is enough
unofficial package: like building from source, but you have to worry about package maintainer too
Same goes for any unofficial flatpak, right? And that is most of them.
In order from the most to the least secure: