Linux distros are vulnerable to the same supply chain attacks. Did you ever do a background check on your distro maintainers? How many of them have email addresses from non-democratic TLDs?

If they want to publicly publish their exploit chain for everyone who uses the distro that's their choice.