How would you explain the difference between org-based and package-based development, and when would you recommend each?

In an org-based model, the org is the unit of work: metadata is retrieved from and deployed to whole orgs, source control holds a representation of the org, and releases move sets of components. In a package-based model, the unit of work is a versioned package with declared dependencies, developed from source and installed into orgs.

I recommend org-based for the large legacy org with a decade of interdependent metadata and no clear module boundaries — which is most enterprise orgs. Putting that org under source control and deploying from the repository delivers most of the governance benefit immediately and does not require dependency boundaries that do not exist.

I recommend package-based when the boundaries are real: a greenfield build designed in modules, an ISV product, shared components that several orgs consume, or teams that genuinely need independent release cadences. Unlocked packages are the internal-modularisation option; managed packages are for commercial distribution with IP protection and a publisher-controlled upgrade path.

The honest middle path, and the one I most often recommend, is incremental: org-based under source control first, then extract genuinely self-contained areas into unlocked packages one at a time. The test for whether an area is ready is whether you can enumerate everything outside it that references it. If you cannot, it is not ready.