Seems like a great attack vector for disgruntled ex-employees actually. All they'd need to do is copy the source code and names of internal packages, then release public versions with the same names and same source code, but backdoored. Developers likely wouldn't notice because things would function similarly at least for a while.