Whether or not you draw a distinction, it seems plausible that the world as a whole would draw a distinction between sharing encrypted messages with the NSA and deliberately injecting malware into widely distributed software. Corporations can look at the former and think it is unlikely to affect them.

So regardless of how bad its prior behavior is, it makes sense that Microsoft has more of a reason to try to keep software distributed through GitHub as secure as it reasonably can.