What are some simple tweaks the "Debians" of the world can do to mitigate this kind of stuff?
Not trust "hand-curated-by-possibly-malicious-maintainers" GitHub release tarballs, only trust git commits?
Whitelist functions that are allowed to do IFUNC/ELF hooking to core OpenSSH functions?
Now realize, those are people having FUN. What is your chance of catching nation state level maliciousness in a codebase? Pretty low.
folders containing test files could easily be removed before build just by name or should live in a separate repository altogether.
If you want to get paranoid about a test subdirectory, stash the payload in comments or formatting choices in the source code itself.
It's great to say "aha, this particular exploit would be deleted by not having binary files in a test directory!", but that totally misses the point that you can put the bytes you want in other places, such as in the source code which is itself a load of bytes. See also polyglot programs and the code is data premise.