If I were some shady Australian spy organization, I wouldn't just demand an employee write some obvious change that rips open a backdoor, I would have my highly

If I were some shady Australian spy organization, I wouldn't just demand an employee write some obvious change that rips open a backdoor, I would have my highly qualified spy programmers write a fix to an existing bug (ticket) in a repository, but inject a subtle bug (buffer overflow, unescaped input), then have a junior programmer commit it to the repository. The junior programmer might not even be able to spot the problem.