Who are the people running GNU/Linux distros? How are they organised?
What checks and balances are in place? both for computer security and organisational integrity (eg avoiding scAmazon Lens style spyware). How effective are they?
Distros began when the only people who cared about GNU/Linux were the geeks using it. This hasn't been true for decades. We really need robust community processes for answering the above questions, at least for each base distro, and major variants.