Not sure if I understand you completely, but I can't help but say bad commits don't necessarily get merged into the trunk / master / main.
As I pointed out in another thread, the journals he published his work to were low tier, open access journals. Anyone can start a journal, and these journals will accept almost any research that's on topic.
So if I were to stretch the metaphor, it's more like he found some fork of the official Linux repository, he submitted a patch that the maintainer just merged in without thinking, and then he used this to show how easy it is to get malicious code into the official Linux repo.