Supposedly wonderful “human artisanal code” has plenty of fuckery.
These are supply chain attacks and in the case of xz utils, the attacker had gone to extreme lenghts to hide the attack from a well-meaning, good-hearthed but overworked and burnt out solo maintainer.
To compare this to bugs that people unwittingly introduce in normal human-written code is not sincere.