Cryptocurrency contracts are going to touch actual tokens at some point.

Even if the compromise wasn't on the developer's machine, it could have enabled a supply chain attack post-deployment.