A backdoored xz could also run payloads hidden inside other xz files, allowing targeted attacks.