Not sure. From what I read they've successfully introduced a vulnerability in their first attempt. Would anyone have noticed if they didn't call more attention to their activities?
"A lot of these have already reached the stable trees. I can send you revert patches for stable by the end of today (if your scripts have not already done it)."
https://lore.kernel.org/linux-nfs/YH%2F8jcoC1ffuksrf@kroah.c...
It looks like actual security vulnerabilities were successfully added to the stable branch based on that comment.