Given this disaster, one or other "foundation" will now embrace the `xz` project, start paying a maintainer or two so that they don't accidentally end up dying from burnout.
Rinse, repeat for all critical-path open source software. A bit like the OpenSSL "Heartbleed" disaster[1]. OpenSSL is now part of Linux Foundation's (they do a lot of great work) "Core Infrastructure Initiative".
Many fat companies build their applications on these crucial low-level libraries, and leave the drudgery to a lone maintainer in Nebraska, chugging away in his basement[2].