That is the insidious question - how many parallel efforts were/are in play when xz was going down? Surely that was not the only long term play to compromise an "unrelated" component of system security. The Jia Tan organization might have already inserted back doors into dozens of different projects by now.