@nobody for something like Firefox etc. a backdoor wouldn't last too long, I suppose, because there are too many "eyeballs", researchers, hopefully better practices, etc. Sure, it might be compromised right now, but I'd expect to find it in the news in a few months if it was so
on the other hand, minor packages are more of a problem, so it might well be that some have been compromised for years and nobody has noticed yet
I imagine it wouldn't be hard for government hacking groups to spot all the "poorly maintained" packages in Debian/Fedora, and start collaborating, even taking over the projects and become the new maintainers over time, because the original devs aren't interested in supporting their software anymore
so one day you might find that John Doe, the new maintainer of that cool little package installed in lots of distros, is actually part of an APT group sponsored by some government
this world is becoming way too complex, and stuff can be trusted less and less. We are all going to die in a cyberpunk dystopia, I say