It doesn't matter if you're dealing with a store run by Apple or Google (or presumably anyone else): the stories are all the same. Presumably because to make the economics work, review and approval are done by poorly trained contractors who don't have time to do a proper job and need to meet quotas. And with anything security related, there's an inherent bias toward not giving information on the exact violations beca…
As Arch Linux user if I found a software I like and want to help with distribution I can create package and push it to AUR [1]. This works as recipe - list of make and run dependencies, configuration, installation. Package is not safe and should be reviewed on installation.
Popular package may be pulled to official repository [2], distributed in binary form. "community" repository maintained by Trusted Users [3], "core" and "extra" by Arch Linux Developers [4]. It is evergreen - rolling release. Some distributions provide Stable releases which should be even safer.
Distributions may remove package, block version, patch to its standards. I think if opt-out addons were distributed by Debian they would be patched to opt-in.
In other words - many 3rd party distributions, by users to users, pulled - not pushed, not required to accept all packages.
[1] https://aur.archlinux.org/
[2] https://www.archlinux.org/packages/