Malice or selling out is not even required. Malware groups are perfectly capable of getting access to maintainer credentials themselves if needed.