Agree. I think a more core issue here is that only 1 person needed to be convinced in order to push malware into xz