> The installation instructions I've always followed for MongoDB start with importing a key, and adding their official repo to my source list.Going with the maintainer's repo means that you trust the maintainer with providing security updates for the version you have installed or you trust them with providing a useable upgrade path.
If you go with a distro package, you will get both the benefits of security updates for the lifetime of the OS itself and the benefits of the underlying software not changing.
Of course it also means that you don't get new features for the lifetime of the OS.
So depending on your target usage of MongoDB, you either would want to go with the OS packages (if MongoDB is just a dependency of a dependency and you don't really care about its functionality aside of it being there) or with the vendor packages (if you're directly depending on MongoDB and you're willing to keep up to date with feature releases).
But even then, sometimes a vendor's official response to a security problem is "run apt-get upgrade to update to the latest major release" at a time when you really don't have the time to read the release notes and adopt your software to the changes in the new version.
Other vendors still provide maintenance for older releases, so it really depends on the vendor, whereas if you go with the OS packages, none of this matters.
Also, in this particular case, there's also the licensing issue to consider. I don't know whether it's safe for a company offering some service and/or application over the web to use current versions of MongoDB without paying for a license.