Sure, but a very long time will pass between it being uploaded and being merged into stable, so there is a lot of time for people to discover your malicious code.

It is not like npm or crates.io where you can just upload whatever random code you like and people will start picking it up immediately.

But it’s not foolproof, sure, I agree with that.