> You mean that every time you write a new project you write your own request parser, your own server, your own web framework, your own database access libraries, etc. from scratch?

No, but downloading random code is just insane.

As a comparison, Debian has ~3000 packages, and every single package had an identified maintainer, with its own GPG key, validated in face-to-face meeting with an ID card by three people, an identified upstream, etc. Each maintainer is physically identified, and has passed a number of technical validation steps, explained his motivation etc.

There is also a dedicated security team that can be contacted 24/7.

The system is not perfect, but it provides a good level of security. And this is a project only made by volunteers.