Ok there's a larger question here about the bazaar software development method.

How can we ensure say, that Microsoft doesn't pay someone to throw a wrench in libre office development or Adobe to sabotage Gimp?

There's lots of deception strategies for bad faith actors and given the paucity of people who actually do the work, it's really really hard to be picky.

Especially with the complexity of library dependencies. Defect-at-a-distance may actually be a common strategy and this is the first that was caught