If xz had been proprietary, would the bug have caught any attention?600ms (the runtime overhead in this case) is a fraction of what it takes to log into some systems.