Who said it has to "generalize"? No virus generalizes to hack every program. That doesn't mean viruses aren't dangerous.

Also OSS makes up most of the modern stack, so access to source code is a given. And hand-crafting a backdoor when you have the source code is trivial because you can literally change anything you want with confidence.