They mean no one can be reasonably be up to date on software security updates, and (ideally) ensuring all packages changes are not malicious (as well as the small stuff like properly integrating to the distro, but idk how void works enough to comment on that)

Some people do an astounding amount of work.

And then there are many, many, which help a little.

Also, if, say, somebody finds that in Debian testing is a malicious package, people which maintain Arch will learn that. Open information sharing between many thousands of people willing to coordinate is a superpower.