The security policy was also updated: https://github.com/tukaani-project/xz/commit/780d2c236de0e47...
The "one guy's little piece of code holding up the world" is a SPOF and much easier to attack than if they had some help and automation.
Typical over-engineering that comes from large corporations.
They will turn FOSS into a walled garden, as if contributing to projects was not a pain already.
The only thing in here that has potential negative impact are the background investigations, but it might be reasonable to have an independent third party that offers this as a service for project leads.