XZ attacker spent half a year earning trust, doing real maintenance.

Different order of magnitude effort spent during XZ attack.