`sudo apt install my-custom-backdoor-script.deb`

With NOPASSWD you would also invite someone pulling a `.deb` via `curl` as part of a supply chain attack in a some non-descript NPM package via a git hook or something.

So you want users to be able to install any package? So that the attack surface is now literally all the Debian archive?

Yeah, no.

You either use `sudo` when you want full root access or for something completely trivial.