An attack like XZ wouldn't just harm the US. A prosecution wouldn't have to be "at the behest of the US government". Kim Dotcom could pretend that his business

An attack like XZ wouldn't just harm the US. A prosecution wouldn't have to be "at the behest of the US government". Kim Dotcom could pretend that his business was legit (just a file sharing service) so he could drag out the court battles. Someone trying to sneak attack code into widely used software would have no such defense.