But there's still a question of "how many people actually review the changelog before updating?" It's a very small number, but that might be okay. If a bad actor pushes malicious code through, all you need is one person to raise the alarm.

In general, Bitcoin is very well reviewed. I don't think it would be easy for a bad actor (even a good actor who is being compelled in secret by a state actor) to push through malicious code. But it's hard to be certain exactly how robust Bitcoin is to this type of thing.

The culture of Bitcoin is highly resistant to changes in the core code. Even optimizations are increasingly scrutinized. Attempts to influence the core devs ("psyops") are also likely to fall flat, simply because the core devs have gone to great lengths to ensure that there is a lot of red tape to making changes, and that larger changes take years to get through with hundreds of eyes of review.