

I’ve used Mobian stable and pmOS stable on both the Librem 5 and PinePhone Pro.
I also can’t give in an-depth comparison, but apart from the obvious (differences in available packages, versions and OpenRC vs systemd), I found them basically identical. Both had difficulty keeping the modem connected for more than an hour at a time, but otherwise did everything I expected (wifi, text messages, mobile networks, adaptaive apps, cameras, music/podcasts, etc).
For now, I’m sticking with pmOS, as, for the current stable version, Mobian doesn’t offer prebuilt Librem 5 images with full disk encryption support (I can’t remember why - this is specific to the device, and I’m hoping it will be fixed in the next release).
Distributions handle this for you. Installing your software through a distro, instead of getting it from each individual software authour, means that you trust one organisation instead of hundreds of individuals.
For instance, Debian has a strict set of guidelines for Debian developers (who have the right to upload packages). They will be familiar with the software they are packaging, are often independent from the upstream authours, and are expected to check the package for various issues, including licensing, security, version incompatibilities etc. In addition, every upload is signed, so you can see who is responsible for everything.
And when something slips through, as almost happened with xz, the analysis and recovery all happens completely in the open. There may not have been enough eyes on xz to prevent the vulnerability in the first place, but once it was discovered, there were at at least hundreds of people dealing with the aftermath, all in the open.
Compare this with proprietary software, where you’d be lucky if such a vulnerability was even disclosed, vs just silently patched.