My point was not that you would review every package's source before installing it, but that someone would. Looking at it from a Maemo perspective, I find it hard to imagine that such malware would last very long in our repositories before someone identified it as obvious crap. Granted Maemo has far less downloads than Android, but open source can only help in this scenario.