If the malicious committer is able to publish releases, that malicious commit might have already reached users (and stolen/deleted their data, or whatever it wa

If the malicious committer is able to publish releases, that malicious commit might have already reached users (and stolen/deleted their data, or whatever it was meant to do) by the time it's detected, and reverting won't help.