XZ Utils made it past all those checks with malicious code from a human.

If they’d been more careful with their tarball commits it probably would have made it into the final and commercial distros.

It made into Homebrew for instance.