Adding a backdoor is not the difficult part, leaving no trace is. People don't know who you are on github, but it's easy for top name companies to track who created the backdoor in great detail. Actually the power of tracing real person is one of the the best defenses.