One thing I don’t see any one mention in the comments, is that you should start paying attention to the “Data linked to you” section in the appstore. As an example here’s WhatsApp and Signal:

Granted that does mean you are relying on the developer and Apple to not be deceptive, but it’s better than nothing and a good place to start.

Arch put out a statement saying users should update to a non infected binary even though it doesn’t appear to affect Arch https://archlinux.org/news/the-xz-package-has-been-backdoored/

However, out of an abundance of caution, we advise users to remove the malicious code from their system by upgrading either way. This is because other yet-to-be discovered methods to exploit the backdoor could exist.