I wonder if that malicious feature was removed from the open release. In addition, if the builds aren't reproducible and people just run the binaries distributed by X instead of building from source, there is no guarantee that they aren't running a version with malware.