Every package distribution system not using DNSSEC, DANE and good SSL/TLS coupled with signed/verified packages can basically be compromised at will. Only Debian and OpenBSD are good on this, to my knowledge.