

You are right, GPG signing is good as well. But in both cases you still have unsigned apps.
What security problems do you think package managers are vulnerable to? If the upstream repo is compromised all bets are off regardless of the system.
Yep. And in such case an antivirus software might come handy.
SELinux doesn’t help much when it comes to desktop apps. AFAIK it’s more geared towards server apps and its configuration is complicated. At least that’s my impression.