Bad actors probably don't have the capacity to check every pull request. Yikes, though. Wonder what the outcome would've been if this was exploited before a patch was available in trunk and ready to be rolled out.