Because a company is not a single entity, rather hundreds or thousands of peoples. Some of them may wish to get your passwords, for instance, a disgruntled empl

Because a company is not a single entity, rather hundreds or thousands of peoples. Some of them may wish to get your passwords, for instance, a disgruntled employee who might want to publish large number of passwords online (or provide access to attackers). Yes, they might also use other techniques as well, for example, push a bad update if they have such privileged access. However, that’s relevant more in targeted attacks; you can’t really push a bad update to everyone before getting caught quickly. Also, often several people have to sign the code (in the case of non-JavaScript code), and there is log trail.