Basically, every disto has it's own repository servers, which are the default option for the installed system to fetch packages from.
This means that when you install a new package or download updates these are downloaded from those repositories.
You (we) trust the repo maintainers that the packages they upload are not malicious. Most of the official repositories offer the sources to the available packages, so you could theoretically download the sources see what it does and compile it yourself. But nobody does that.
Some time ago most package repositories implemented a package signing feature. Each package uploader has a personal signing key with which he signs his packages before he uploads them to the repo. That stops a malicious attacker (who has broken into the repository server) from serving his altered packages. It does not affect the actions of the uploader though, who could if he wanted serve a modified package.
The way the package management in most distos work is for a package to be installed system-wide it has to be installed with root privileges. Each package has hooks that must be run before and after installation for it's correct setup, and these too run with root privileges.
So you could, again theoretically, update you system, download a malicious package without even knowing it.
The point that Shuttleworth was trying to make is that if they, as Canonical, wanted to run something malicious on our systems they already have a way.