Only part of the backdoor was in the source code. It was split like that between the tarball and the code to hide it better. But, yes, with reproducible builds

Only part of the backdoor was in the source code. It was split like that between the tarball and the code to hide it better. But, yes, with reproducible builds they could have put all of it in the source.