For sure, I think that last part is underestimated but powerful. When the SolarWinds or similar attacks occured, we had to rely on investigation reports put out

For sure, I think that last part is underestimated but powerful. When the SolarWinds or similar attacks occured, we had to rely on investigation reports put out via PR teams and such about how such an attack occured, what processes missed it, etc. With the xz attack, every step of the attack was out in the open for everyone to analyze. Or at least the vast majority, if there were private emails exchanged between "Jia Tan" and the original maintainer, those we can't recover. But we can see pretty much every other aspect of the attack.