I ask because I have run Arch in production for the past 3 years on about 10 servers without any problems (knock on wood). Only official packages and always after quickly testing the latest pacman -Syu on a test machine.

Compare to a couple Ubuntu servers I have to deal with I have to go out of the way to get more recent packages, which are often unofficial (I avoid having to build packages where possible).

With something like Debian, you have layers of package maintainers in the middle to insulate against attacks, and specific, immutable bundles of data included in the packages themselves. Also, the entire Debian infrastructure (signing keys and all) being compromised, and such an incident going unnoticed, is a much less likely occurrence than the same for the hosting site some individual software author uses.

Sure, you can still add third-party repositories to Debian and install deb packages from outside the main sources. But when you do that, you're making a conscious decision to do so, on a package-by-package basis. Any package you pull from AUR could be vulnerable, unless you manually check the source of each and every one. When you install from the Debian repos, you can trust that a certain standard of quality and security is being upheld.