>Unless they specifically hardcoded a back door into the game, I’m dubious a leak would result in an RCE so quickly, if ever.

AFAIK, parts of the source code have already been leaked since 2018 amongst certain circles outside Valve. It's only been in the past few days that this is now common knowledge.