But I absolutely do not trust any of the software I install from the distribution's repositories. The packager doesn't analyse the code for all the software they add to the distribution, so it cannot be trusted.
Personally, I use Qubes OS, but people who's don't still deserve a secure operating system.
I'm very happy with the packages I get from Debian.
https://www.debian.org/doc/debian-policy/
Add a bit of common sense, and it is enough for me (and I assume for most people, but hey!).
The solution is to simply not trust the software at all. This is the approach Qubes OS takes, and works really well. Most regular users don't really need to go as far as Qubes OS does though, and application level isolation that Flatpak is trying to achieve is enough.
I don't see how anyone can accept that any random piece of software is allowed to access all your personal files is acceptable. We certainly don't accept it on mobile platforms (how many posts do we see here about applications that scrape user's contacts?) so why should we accept it on the desktops?