If you have access to the build server you can modify the code, after pulling from the repo. Or, if you have access to the binary repo where the code is pushed

If you have access to the build server you can modify the code, after pulling from the repo. Or, if you have access to the binary repo where the code is pushed by the build server after building (often just a file server and FTP) then you can place your own binary. Of course it us possible to use crypto hashes throughout the process to prevent these kinds of hacks from working, but... If you do that, then the security process itself is what hackers will attack. To prevent installation of exploits you really need to pay serious attention to the whole release process and not assume that anything is simple or secure. Only the paranoid can succeed in security.