Personally when I install some software I generally look at popularity (like stars if the code is hosted on Github), whether an audit has recently happened, it is recommended by someone I trust, and whether the permissions it needs are reasonable (I’m on Silverblue so I only install Flatpaks)

When I used to use Arch I also looked at the pkgbuild beforehand since they’re generally fairly small en very human readable. I also looked at popularity there and whether the developer maintained an Arch package. But that obviously doesn’t say anything about the code itself.

I definitely don’t consider myself non-techy since I’m doing an an engineering masters with a CS track but those things shouldn’t require any programming knowledge.

But I think most of the more common users don’t really care and install the packages they need without thinking too much about it. Unless the source seems very untrustworthy.