Are Debian repos a viable grift target?
They absolutely are and that's why they're tightly curated by maintainers.
What does that have to do with Android and iOS?
They absolutely are and that's why they're tightly curated by maintainers.