It's one of the questions we're asking ourselves internally at atlassian. The only upside to the law is it was written without any idea of how modern software development works - any backdoor or explicit code injection should be caught at the pull request stage.