A backdoor in xz

This is inaccurate. The backdoor code is checked in, and isn't able to modify the artifacts in itself. What isn't checked in is a backdoored m4 macro that injects code into configure, which in turn extracts further code from the test files and injects those into the build. It's kind of expected that configure is able to influence the build process, and compressor test files are inherently going to be binaries, so really the only red flag was the difference between the git repo and the tarball - a difference that's largely expected, given how autotools works.