A deb package is technically gluing of two tarballs: "control" and "data". This gluing is done using an ar archive as ar is a very light-weight archive that adds very little overhead. Here is the content of that archive for some random package:
$ ar p $PACKAGE.deb control.tar.gz | tar tzf -
$ ar p $PACKAGE.deb control.tar.gz | tar xOzf - ./control
Maintainer: CDBS Hackers <email@example.com>
Depends: debhelper (>= 5.0.30)
Description: common build system for Debian packages
This package contains the Common Debian Build System, an abstract build
system based on Makefile inheritance which is completely extensible and
overridable. In other words, CDBS provides a sane set of default rules
upon which packages can build; any or all rules may be overridden as
The rough equivalents of those in an rpm package is:
data.tar.gz is the cpio archive you mentioned. The metadata and the gluing in a deb package are done in a way that is at least accessible through standard shell tools. It was originally done with some custom dictionary and custom gluing as in RPM, but later on they preferred to use a more standard method.
I'm sure there are some merits to the rpm format. It's just that your criticism is wrong.