Linux as in the kernel? Who is "they"? Torvalds?
The ones that control whatever source you are pulling the updates from. Very very few people are building everything from source and reading the source in full everytime.
Notice I am not saying this is likely. I am saying that it is theoretically possible anytime you accept code from the outside (doesn’t matter if it is pull or push)