What if over 80% of all open source projects are secretly sleeper agents for various malicious actors, states, terrorists and whatnot, and they pretend to give use precious software updates for free so they can attack later?
What if proprietary software is running the same way, except they don't even give you free updates and you can't audit the source code and have to trust them when they push updates?
What if your mother gave birth to you just so she can slap you in the face when you're 30?
Yeah, we can go very far, but in this moment, xz is under so much scrutiny that in 2-4 weeks, I'd trust it with my life unless the big orgs looking at it issue more reverts (hence, the delay). So if there are issues, they're everywhere else.