They all had flaws and holes in their package manager in the past, or how are they magically 100% secure?