The Debian Linux distribution became the de facto Linux software repository, package manager, and verification/security gate-keeper. The Ubuntu Software Center eg is a frontend into the Debian Repo.

It is extremely important for the vast majority of Linux developers, that they get their stuff listed in the Repo asap, because the vast majority of stuff not in it, was actively rejected. If you aren't Repo'd, the default assumption is there's something bad-wrong.

Today, Linux wares are written with one eye on the Repo requirements. The easier & smoother for the Repo authorities, the sooner your new package becomes socially acceptable. Not everyone & everything not in the Repo is criminal; there are specific contexts & reason why a project will not have been vetted. But the worst is the default assumption, because it is mostly true.

The package manager systems in Linux let the user seamlessly install software from the Repo, while riding herd on all the dependencies. It's a marvel. However, this dependency-management operates on the critical assumption that all the packages have been thoroughly shaken-down, are all compliant & consistent. That's where all the work really is - whipping all those applications into proper shape, so the click-n-play Frontend can look like a genius.

It so happens that the Linux app-count, and the WordPress app-count (plugins and themes) have converged. You're looking at roughly 45,000 for both systems. Apps in Linux are bigger, but they are mostly compiled. WP apps are mostly smaller, but many are spaghetti/omg-ware.

Vetting & proofing packages is the main work in keeping the Linux Repo viable. It is one of the largest & most-elite projects in the OSS world. Without this huge grunt-effort, any dependency-manager (including Composer) is just a GIGO-upgrade.

The job in prepping WordPress plugins and themes for dependency is of the same approximate magnitude as doing the same for the entire Linux operating system and all its applications. But then, Linux is a fabulous system, significantly because they make this effort.

Can WordPress address a challenge of this scope & scale?

From Dwain Maralack's using-composer link, above:
So we’ve got WordPress installed and now we want to add some plugins. Thanks to composer-installers we can install them in the proper location right?

Yes, but we’re limited to plugins that have a composer.json, require composer-installers AND have their package type set correctly. Obviously there aren’t many plugins that actually do this yet. But you can find an example here.

In the Linux Repo, security has become official paranoia. Not only does the software have to be vetted - the vetters have to be vetted. The new system-layer that supports & enables dependency-resolution, also delivers new kinds of power to those entrusted with deploying it. There have been horror-stories. Safeguarding against misuse of the new powers will be another tough-nut, in the WordPress culture.