Like when you run apt install some-package who says that some-package doesn’t contain malware?
The Debian (or Ubuntu) package maintainer says that. Having an application package available in a distro's official repository is an endorsement of the safety of that package.
This is something people need to appreciate before they go adding PPAs and flatpaks and whatnot willy-nilly.