Unless you're running Gentoo or similar, you're trusting your distro maintainers to produce clean, non-malicious binaries any time you install anything from the package manager.
Choosing to download and run programs is not giving someone else RCE, unless you download and run something that allows for RCE. It's not an inevitable truth like it is with Windows or (usually) Ubuntu (not sure about MacOS).
So what's your approach? Are you Amish? Or did you compile every component of your setup (UEFI firmware and [C,G]PU microcode included) from source after auditing it? Or are you just convinced that a system that can't have a third party run arbitrary code simply can't exist? Please elaborate.
Well, you hit the nail on the head with Ubuntu - I've been trying to cut that distro out of my life, and it keeps popping up every place I've worked at. I trust Debian dearly, but even then - there's just so much surface area! At least Debian is easy to strip down (and the docs are quite good). These days I like to be explicit about everything I have installed, and still - things seep through.