Because it's often easier, and because they're not "questionable tarballs". People seem to have forgotten that all of this has been working well without all th

Because it's often easier, and because they're not "questionable tarballs". People seem to have forgotten that all of this has been working well without all that many incidents for 35 years. And these archives are published by the same people you trust to run code on your system. It's not like you can't hide this kind of stuff in the autotools soup committed to git. I doubt this would have been caught it – the "sneak it in the .tar.gz only" was just a bonus defence against detection. I'm not saying using git isn't better, but we also need to retain some perspective on all of this. This ibus thing for example seems entirely innocent. The core of the issue is "who do we trust to write code for us?" Maintainers protect us from randos submitting malicious code, but who maintains the maintainers?