@AlgorithmWolf Pretty much summarises my opinion on the whole xz thing here. There is nothing wrong with paying people or companies to audit your code if you have the money to do so, and it should especially be done for software that entire industries rely on.