The xz story shows that you cannot even trust "core developers" of a longterm project they work in because they might turn one day into attackers.