[BSDobelix]

>The whole point of foss is that any upstreams have very limited privileges compared to downstreams.

I would say introducing a backdoor (xz) without downstream knowing is probably the biggest "privilege" you can have on a system or distribution no?