A small difference I noticed between the two systems: Gentoo sets FEATURES=network-sandbox by default so that no network access is provided to the build process beyond the initial fetching of dependencies dutifully listed and checksummed in the ebuild/manifest. Of course, that implies users read said ebuilds, I know...

Another even smaller difference is no third-party tool is needed to use overlays, Portage (and eselect-repository for convenience) are already there.