Do you want me to upload a package with rm -rf / in postinst? It is so obvious that installing a package might damage your filesystem. But this is true regardless of the package coming from a repository or from your local file system. The decision to only allow packages from repositories does nothing for security.