Completely disagree. Every project that has xz/liblzma added as a dependency should be looking at the source, compiling from said source and making sure their binaries that they shipped with their software match this. For example, homebrew should do this. If the attacker configured the backdoor for the server to enable a universal master key, who's to say they didn't engineer a backdoor for the Homebrew version to export private keys from the current user's .ssh folder?