That would still stand out as a sore thumb. Deliberate introduction of hard to exploit 0days would be precisely how they would do it. All you need is one plant

That would still stand out as a sore thumb. Deliberate introduction of hard to exploit 0days would be precisely how they would do it. All you need is one plant with commit access.