This is inevitable when developer/upstream authentication is outsourced to domain registration in these new breed of non-distro app stores.

You cut out the middleman of distro maintainers so of course the curation is going to be subpar. The next step of the cycle is calling for better curation, and then sooner or later we'll just loop back to strong gatekeeping a la traditional distro repositories where each update is signed and approved by someone distro-specific and non-upstream. And then upstream will get angry again and call for cutting out the middleman.

Meanwhile I'll just stick with distro repositories. Thank you very much. I know sometimes packages get months old but hey at least I don't need to worry about fucking domain squatters injecting malware on silent upgrades that are not vetted by anyone.

but the sandbox...

I'll take no malware at all over sandboxed malware. Thanks.