no. We have to assume any commit of the threat actor to have been malicious. Given that 5.4 contains code by the threat actor, it's not safe to claim to not be

no. We have to assume any commit of the threat actor to have been malicious. Given that 5.4 contains code by the threat actor, it's not safe to claim to not be vulnerable. Not vulnerable to this specific backdoor, sure. But I don't feel like 5.4 is safe either.