Still it's not clear how the SCM vendor is supposed to mitigate against this? If an attacker can inject code onto a machine inside your enterprise (and they obv

Still it's not clear how the SCM vendor is supposed to mitigate against this? If an attacker can inject code onto a machine inside your enterprise (and they obviously can) then you're pretty much screwed whatever you're running (because someone has to be running something that can affect production systems, be they developer, administrator, etc.)