[okket]

FYI: Transmission binaries are now hosted on GitHub, so it is very unlikely that anything like this can happen in the future without compromising developer machines.

[lucb1e]

Question is, how implausible do we think it is that a developer's computer gets compromised?

[fastball]

Well, a developer's local machine will typically be much less likely to be compromised than a always-on, publicly-broadcasted machine.