Debian has a dedicated security team with vastly superior understanding of security issues -- and more resources -- which simply isn't the case with Quicklisp.

And even so, there have been Debian debacles [1] and allegations of compromise by nation states [2] to drive my points home.

[1] https://trailofbits.files.wordpress.com/2008/07/hope-08-open...

[2] https://www.youtube.com/watch?v=UFFTYRWB0Tk