Considering how long bugs can go unfixed and undetected even in large open source projects, I think it can totally happen. Just create a backdoor that looks lik

Considering how long bugs can go unfixed and undetected even in large open source projects, I think it can totally happen. Just create a backdoor that looks like an honest mistake, submit it in a PR that adds some feature or fix, and exploit it at will as people update. Heartbleed took over 2 years to find and fix.