presumably the code being distributed to users could then be redistributed by those users, making this not a SPoF

it just happened to be an overly trusted point of failure