They wouldn't, but build scripts are a particularly effective attack vector.