This is truly sad. It's basically people saying, "Because we didn't properly secure it, we're not going to secure it. Instead, we're going to trust someone else's security, so nobody will blame us if something goes wrong."
one advantage of a self-hosted repository is that the PHP developers may be able to figure out to some extent who cloned this backdoored version.