What if they wanted to modify the source archives of some other project hosted there? Obviously the kernel is a big target, but it seems there are lots of other less-widespread things on there that would be useful to backdoor.