Flagged: How is this "via a project dev"? Which project? The guy doesn't seem to have anything to do with the discovery of this backdoor, and he just summarizes Andres Freund's announcement.
If you want clarification on something, you can just ask instead of announcing that you've flagged it.
It's included in Lasse Collin's FAQ now that he has been found, but in his absence, Sam was speaking for the project on IRC chan and filed the gentoo bug also linked at the bottom of in Collin's FAQ:
https://tukaani.org/xz-backdoor/
You could have just asked and I could have elaborated.