I probably should have said “may/could” sneak in, I forgot the xz incident didn’t quite make it to Debian (but would have had it not been caught)

I would say you are more than likely fine, malicious code does occasionally sneak into Debian distributed apps but you’ll likely never encounter something that is outright fraudulent or a scam.

People who can’t operate a computer will somehow become gods at following instructions if someone calls “from Microsoft”