Any APT repo can push any package, e.g. this repo can give you a backdoored bash package
Sometimes repositories have duplicated packages, I'd be surprised if packages in earlier named repos didn't have precedence over later named repos. Meaning Microsoft couldn't just replace bash.