The difference comes from the fact distro maintainers choose the software they package, while language maintainers largely don't.

For example, how do you prevent somebody from phishing/typosquatting users with a package named similarly to a popular one? For distro maintainers the answer is simple - don't package it. Debian is unlikely to add a "f1refox" package. Language maintainers don't have that luxury.

Because they both have very different management processes (centralized vs distributed) and release cycles. They solve different problems.