The "backdoor" isn't the package that got leaked, it's the private key that signed the package. Without the key, the deployed packages wouldn't be serviceable in case a real exploit was found. Without a serviceability plan, they couldn't have released Secure Boot. So the question isn't whether there was a back door - there had to be a back door - it's whether Secure Boot is a legitimate thing to have.