Which indicates a different problem if the sabatuer was on that short list. And in this day and age of cryptographically signed commits, the number of people who could do this should go down even further.

Given this, I think it’s much more likely there were few or bad controls, than a person in an incredibly privileged position working in the margins.