APT is not good at managing dependency hell. This is a common problem for all package managers that don’t typically bundle dependencies. You can get 30000 open source packages from trusted sources having a maintainer working on each to all share the same dependencies for an OS release. That’s what Debian does. However it’s a lot of work and that works increases significantly when you try to do it for a piece of software across OS releases.

Read - it’s difficult for LibreOffice or Mozilla to ship a new version of their software that works on several Debian or Ubuntu releases. It’s also difficult for maintainers to do that.

You could of course include dependencies in debs, but then you’re increasing the security attack surface of the OS, because there’s no sandbox around those bundled dependencies. Bundling dependencies requires sandboxing to be safe. Otherwise whenever there’s a security hole in one library in package X, package X might patch it, but the same library might exist in another 50 packages on the system unpatched.

This is a solved problem. It was done in Android, iOS, BlackBerry 10 and probably others. All OSes that had to deal with more than 30000 packages, open source or proprietary, from trusted or untrusted sources. Bundle non-system dependencies and confine in a sandbox. Snap’s been doing this ever since it was called Click. Flatpak didn’t have the sandbox part for a while if I’m not mistaken. I’m not sure what its current sandbox state is.

There are other issues with APT/deb but managing dependencies without sandboxing is probably the most fundamental one since dependency management is one their fundamental purposes.

Aren’t you sorta trusting whoever wrote any package you install with root? I mean, you should have that attitude anyhow as packages have a huge attack surface so privilege escalation bugs are way more common than remote execution but still, flatpak and snap at least offer a bit of a sandbox which might improve…