We dont need any tinfoil hats. FOSS projects were being backdoored even before they became a thing the difference is that this time it's state sponsored actors doing it.

The old groups GOBBLES,ADM,ac1db1tch3z,~el8 were doing it, private "security researchers" like isec.pl were doing it.

This time it's a problem because state actors are abusing the corporate capitalism that created this era of underpaid people working on foundational projects. The bad actors have unlimited resources for their objectives.

That's basically what created the demand and ineption of groups like NSO,Zerodium etc..

Basically before that exploits and backdoors were worthless and hackers hoped to be sponsored or hired by companies like Qualys.