@snaums to a first approximation yes, but also things like homebrew or other build systems which don't necessarily look like "distributions". rsync is a thing which gets packaged and updated and people tend to not look too hard at the updates because its reputation is (was) so good