Well, at least now we know it's widespread [0].
https://news.ycombinator.com/item?id=18693073
I've often thought an interesting place for an intelligence agency to place or recruit a source would be in a code review organisation. There are a couple of high profile ones that do a lot of work on open source projects. Let's be honest, very few people have the time, energy and skills to review a project independently of this.
Of course there comes a point where too much tinfoil makes the hat fall off.