Yeah, with a 2-3 year wait to know whether you succeeded or not, I doubt you'd put all your eggs in one basket.

Yes, unironically, that, being a huge leak, really convinces me that we all have multiple RCEs on each of our systems. I mean, we already kinda knew that, of course, but even now that I'm typing this it's a bit hard for me to actually believe it. But realistically I think it's pretty much a proven fact. This level of sophistication… what did I even expect? Of course well-payed teams of high-level professionals are working in this area for a very long time by now. This is basically like professional football players competing against office workers in their late thirties who like to kick a ball on weekends. I am comforting myself by thinking that something a bit more high-level, written in python or even golang, or, oh hell, maybe even rust would be more a bit more transparent for other contributors… but even this is probably a lie. And if it wouldn't be, surely tons of super-popular low-level packages written in C/C++ are as good as incomprehensible for somebody who isn't specifically security-auditing this.

yep, maybe it was a false flag to take people's eye off the -other- backdoor lol

Occam's razor says that the perpetrators likely didn't spend years building up trust to hack some early adopters before the releases got more stable.

It would be like spending hours baking bread only to eat it before it goes in the oven.