I am pretty sure the distro packagers all know where to get the real code from, and its packaged for everything that runs X so minimal risk.

Also assuming something on github is the official repo is dangerous anyway. There might be multiple repos with the same name, there might be a more actively developed fork and the official one might be unmaintained, etc.