[parl_match]

Inserting a change like this as a one off would cause lots of scrutiny, which would probably get it detected. Instead, the bad actor spent years contributing to the project before dropping this.

So, while writing the exploit might be a couple of hours work, actually pulling it off is quite a bit more difficult.

[londons_explore]

Plenty of open source maintainers spend only a few hours a month on their projects.

For many projects, that is enough to become the main contributor.