Any proof to back up that statement? Anyone trying to distribute spyware in a distro would also need to change a shedload of other software that can detect or report it's activity to have a snowball's chance in hell of getting away with it for more than a few days and any changes of that magnitude would soon be detected through digital fingerprints.

TL:DR Calling BS on that.