And yet on Linux the advice seems to be never ever download directly from the developer
That’s just advice for making life easy for new people, because distro-packaged software is more likely to work well with the operating system. I run packages from devs, even nightly automated builds of stuff, all the time.
If the device is owned by a business, sure, IT should lock it down. If your average Joe owns his device? He should be able to break it if he wants. He owns it. This argument only serves to enrich the exploiters, not protect anyone.