Sure, but I’m sure they leverage portage due to its sheer power and additional scrutiny over any ebuilds they source from upstream. Which, to be clear, the threat model assessed internally is intentionally malicious packages which are unintentionally merged into the portage tree by legitimate and well meaning developers. There’s no immediate issue with the portage or gentoo developers and package maintainers themselves.