Most distro's I know have some kind of repository functionality where new packages could be downloaded after installation. Which distros do this in a secure way and which doesn't do this in a secure way. I'm especially thinking about attack vectors like man-in-middle and problems like breach of security on both the repository meta server and the repository file mirrors. I have heard that both Slackware and Arch linux are very vulnerable because they lack package signing. Is this true? Are there any other major linux distro's that are vulnerable for simple man-in-middle attacks? 
Which linux distro's package repositories are secure and which are not?
security;distros;repository
This isn't a direct answer to your question, but there are several things you can do to mitigate against this risk. The simplest one is to check your downloaded packages against the checksums from a different mirror than you downloaded from.When my package manager (poldek) downloads a package, I have it set to keep a copy of the downloaded rpm in a cache folder. It automatically checks the checksum of the download against the package repository and warns/aborts on a mismatch, but   if you were worried about man-in-the-middle attacked against your distro repository it would be easy to write a secondary script that browsed through all your downloaded packages and verify them against checksums you download from a different mirror. You can even run your first install as a dry-run so that packages get downloaded but not installed, then run your verification script, then do the actual install.This doesn't stop a compromised package from getting into the distro's repository, but most distros have other ways of mitigating that, and even signed packages would not guarantee this was never a problem. What it does do is stifle the targeted man-in-the-middle attack vector. By using a separate source and downloading on a separate channel, you kill the ease with which a compromised package could be dropped into a tapped line.