The issue here is the attackers will quickly move away from an individual attacking you to the group attacking you. The person writing the infected code will never be a jerk to you at all. You'll just suddenly see a huge portion of your mailing list move against you ever so slightly.
We've complained about bots in social media for a long time, but how many people in open source discussions are shady manipulative entities?