@q3k @marcan tbh the fact that it did trigger alarms in those systems, and despite that nobody noticed anything suspicious until a downstream user noticed the backdoor's side effects after upgrading is also telling.
I'm on the receiving end of some mandatory analyzers and due to the sheer volume of hits most of the time I don't really care about why something was found, rather just how to get rid of it. They could safely ignore these systems because of this behavior.