The attack on xz illustrates that even if the code is open source and the build is reproducible, well-designed attacks can still be executed.