How did they bypass the review process? Was the process socially engineered, or was the repo hacked directly?
What will the new process be to ensure this doesn't happen again?
This has implications for the process at most companies.
How did they bypass the review process?
For example, changing the repository from Mercurial to Git. Splitting or combining two repositories. Moving lots of files between directories. Running an autoformatter over the entire codebase. Something like that.
I'd wager there aren't many reviewers with the patience and attentiveness to spot 1 evil change among 1000 trivial changes.
Sometimes I wonder how difficult is it for $TLA to send their employees off into the world (on their payroll), as sleeper coders, to be activated whenever a small piece of code needs to be inserted in the right place. You don't even need too many; just a handful would be sufficient.
Disclosure: I also worked for Juniper by being in a startup acquisition. I don't remember any audits of our existing code.