> Debian maintainers don't have the time (or often the knowledge) to review upstream changes
> Do you think the Debian Linux, GCC and Xorg maintainers exhaustively review and understand every patch? They don't.
This is plain false. While it's impossible to guarantee a 100% code reviews, the number of bugs and vulnerabilities found, reported upstream, and patched by distributions (especially Debian) shows that code is being reviewed.
That's a hard pass for me!