Open sourced apps are absolutely vulnerable to this “attack vector”

Did you already forget about the back door in xz utils?