> Given that Debian doesn't give the user any indication of the fact that it even has modified an upstream piece of software

Debian also doesn't give any indication that we haven't modified an upstream piece of software. Modifying software is a central thing to do in the FOSS world. If the user wants to know if anything was was modified, and if so what, then the source is of course freely available.

> it's obviously perfectly possible for them to insert themselves without you even knowing it.

They didn't "insert themselves" anywhere! You, the user, inserted Debian!

> And in that case, according to the developer, even introduced subtle bugs.

Of course, any software modification can introduce, alter or fix bugs. Or all three.

> So you can run buggy software as a consequence of some maintainer thinking they know more than a developer

That can happen. And sometimes you run less buggy software as a consequence of "some maintainer" knowing more about the system as a whole than the software's original developer. Or caring more about safeguarding the user's freedoms or privacy.

> and not even know it because you have no practical info about that process.

"Practical info"? What exactly would you like, beyond a changelog and the the source?

> This is of course not a "choice" in any meaningful sense of the term.

Of course! You chose to run Debian. Debian is entirely upfront about this!

> Nobody ever actually wants to use a buggy php library maintained by debian over a functioning one maintained a by developer

I can't speak for PHP myself, I don't use it at all, but I'm almost always extremely grateful to the maintainers of the packages on my Debian systems for the (often very tiresome!) work they do in adapting upstream software to fit Debian Policy and the Debian Social Contract. (Disclaimer: I am a DD myself.)

> they very likely just never even were aware that that is what they were served.

Would it help if the Debian install guide hade a note saying "be aware that a Debian package may not be exactly the same was what was shipped by the software's original developers – Debian aims to build a coherent universal operating system centered around our Social Contract and Policy"?

Why does Debian change software?