Since installing applications on Linux is usually done through some centralized package manager or app store (Flathub), it almost entirely eliminates this attack vector.

xz moment.

Yes, I see that weasel word "almost" in that sentence. I expect it's going to be doing increasingly heavy lifting as Linux becomes a more lucrative target to attack over time.

Your point generally stands, though. Even if they're fallible, at least someone is vetting it at all somewhere in this pipeline.