and yet OpenSSH was almost the victim of a giant hack too (xz-utils)