I wouldn't call it crap-ware. Sure, it's turned on by default but there is an option to turn them off.
I honestly don't have much experience with Ubuntu or this sort of thing, so I really don't understand it.
But your comment could be equally applied to the crapware installers? Most stuff could be opted-out of - if you're actually careful and ignoring the UX dark patterns (like small print, grey skip buttons etc).
NO.
(I mean, at least it's HTTPS, but still.)
The truth is that program isolation sucks terribly on all operating systems that one might reasonably use for a development machine. Fixing that would be so great, but a lot of work.
[1] Perhaps you're the lone wolfling who doesn't do that, but I have seen this kind of behaviour from people on the don't-pipe-wget-into-shell bandwagon.
(Still doesn't help if the software package itself - that is the canonical copy - is malicious - but prevents MITMing from anyone that doesn't have that particular certificate, at least.)
That being said, you have a (very) valid point. Modern OSes are... not exactly secure.