Treating everything as if a contribution is done by an unknown entity (or worse, a hostile entity) is more work than generally people in a community want to do.

Treating everything as if a contribution is done by an unknown entity (or worse, a hostile entity) is more work than generally people in a community want to do. Social communities are built on trust. With the XZ utils backdoor, people are currently removing any contribution done by that attacker. Even if the work done is of limited quantity, evaluating every character and every byte is a huge endeavor requiring large amount of man hours. At some point it often is easier to discard code then doing the necessary in-depth analyses and testing in order to determine with a 100% certainty that the code do what the code should be doing with no side effect, security issue or legal implication.