It was bound to happen, I suppose. I wonder if it will happen to Linux too, although I think it would be hard for malware writers to target Linux using conventional methods if users stick to using only open source software.
They don't look much like Windows/OS X botnets; instead of this trojan horse stuff they'd just crack insecure services or guess poor passwords and escalate privileges automatically. If you have any Ubuntu servers, tail /var/log/auth.log (similar names on other distros) you'll see trying to ssh in.
The only thing preventing this from happening in Linux is a lack of interest by trojan writers (they could already do it with vmware workstation which is surely available on pirate sites and requires root privileges to install) and perhaps a lack of proprietary 3rd party software (which I'm sure a lot of people will say is a good thing, but that's another discussion).
Repo security is certainly very important. But well, ultimately you have to trust someone?
But I guess that there are two ways to feel really secure : either use openbsd, or just don't use the internet.