Most people don't package their software for distros.

Smart distros keep things close to upstream so the burden is small.

This is a weird argument.

Now you want each developer to manage dependency updates for their application? I don't trust them to develop their own app let alone apply security patches properly.