They don't seem to put much effort in proactively blocking residential VPNs though?

Can't you get USB modems and cram a SIM inside? Are carrier networks really more scary than the internet at large?

If that was the reason then Windows laptops with WWAN wouldn't exist.

Counter-evidence: the Google Play Store, which is a wretched hive of scum and villainy.

And also malware.

>Repos such as AUR

AUR isn't a traditional repository but more functions like a paste bin for package build scripts you have to go out of your way to enable and use at your own risk. It is not how actual Linux repositories work which are way more safe than google or even apple app store.

> way more safe than google or even apple app store.

Probably because of how people submit directly to the commercial app stores and the app store staff are expected to accept them as long as no malware or other problems are detected. Such problems are generally explicitly listed on Terms of Service and app submitters may be able to dispute rejections. Meaning problems generally need to be concrete and justifiable. Also, because of the sheer number, problems are likely scanned for, rather than each app being personally considered by a developer.

FOSS distro package repo maintainers generally don't have any such pressures. They get their absolute pick of what to include from the wild, only taking as much as they're able to handle.

Also, distro repo maintainers handle the building from the source code themselves, while app store apps are closed source to the app stores. Their ability to inspect apps is very limited.