First, the "bug" jumps through several well-crafted hurdles in order to hide itself from co-maintainers, package maintainers, and anyone else who might be looking. Hiding code in binary objects, hidden within in testcases and injected into the build under just-so conditions, would be incredibly difficult to justify with any other intent.

Next, the affected codepath skips itself if it's not executed under just-so conditions. Specifically testing to see if it's being run interactively to avoid diagnosis, and testing to see if the executed binary is sshd.

Lastly, what good reason could a compression library possibly have, for overriding encryption routines in sshd?

It's a fair question, but it doesn't survive inspection at all. This is like finding someone in a ninja suit, wearing night vision equipment, creeping around a museum in the middle of the night, with the crown jewels in a bag slung over their shoulder - and asking yourself if they're perhaps a lost tourist.