A reasonable person would expect many more open source projects have been infiltrated and have similar exploits waiting to be found. Hard to prove until the next one is found, but if a second one like this is discovered we probably have a huge problem on our hands.

Since the part that takes longest is getting commit rights and there's a lot of waiting to do, what are the chances the attackers put all their eggs on infiltrating one specific project? I'd be trying to infiltrate at least 10 or 20 even if I were alone, to increase my chances. If you dedicate one or two years to build reputation with the current maintainers by doing a PR here and there, you can do that for a few projects in parallel.