A backdoor in xz

You can still turn it into a “vendors suck” narrative since the dependency on xz is not there in OpenSSH, nor in the Portable version, but was patched in by Linux distributions.

Of course there is a reason for that — the upstreams don’t want systemd integration as it doesn’t fit their vision for the project. In some friendlier alternative universe upstream could have said “okay we can add the feature, but linking in the whole libsystemd is too much extra stuff to audit: any chance you can provide a slimmer library?”