@Humpleupagus @Tony > If a sufficiently motivated, unscrupulous person can put themselves into a trusted position of updating critical software, there’s honestly little that can be done to stop them

Well du-uh, since that's also true for any closed source setting...