Updating is fine as long as it's from a auditable repository with full source code history, and built by a third-party like a distro (or the build is reproducible).
A repository with history is not enough. It's easy to circumvent.
You need software packages reviewed and signed by trusted parties - aka a traditional Linux distro.