They played the long game.

Can only imagine that the Bitcoin Core repo has long been targeted. Hell, implementation forks like Knots with only a handful of developers are prime targets for a similar strategy.