Exactly, the xz issue is news because it (almost) by-passed the maintainers. For other packaging systems malware is already the norm.