xz is not a "trusting trust" attack, it is a "your build tools are too complex for you to understand all the input and output" attack.And guess what: that's very relevant to web development...