Do you think the presence of a code review practices alone will be enough of a deterrent against agencies using devs for this purpose?

Even if you pressure someone to make a backdoor and they get caught, you've just exposed your intentions when it could have been easier to go straight to the company.

I don’t think A PR is the only attack vector. I would be suspect of the entire CI/CD pipeline and any production systems or distribution systems in employed

Also, if I were an Aussie and I'd gotten a request like this, I'd feel pretty incentivized to make the backdoor as blatant and suspicious-looking as possible. The government ordered you to do it; it did not order you to do a good job.

So "evil PR" would probably be the easiest thing to catch, and it definitely seems like other compromise vectors are where the real danger is.

    public function rot13_GbgnyylAbgNOnpxqbbe()

Something subtle like that?

Fwiw the UK has near identical legislation and I'm pretty sure the Aussie gov looked at ours first.

We lead the world in subtly corrupting democracy.

What if you accidentally cast your coding session to your Twitch stream?