It is worth noting in point 3 that you also get an integrity check and a signature verification when using package management. I typically check the md5sums and gpg signatures for FOSS applications when installing them on Windows, and it is quite the pain to have to do so manually (obviously without native support; I use GnuPG and UnxUtils).