Minecraft got in trouble when the Afrikaans translation had the n-word (in English) due to a malicious translator. CDPR had an issue with the Ukrainian translation making references to the ongoing war.

This sort of thing happens somewhat frequently. It's the same reason how fake sign language interpreters can hold positions. It's hard to verify the accuracy of a translation in a language you don't speak. They have to trust that the translator did their job right.

Translations are usually just text strings. No reasonable project would allow translators to write code.

I would assume since it was a block of raw text in Ukrainian in a translation file, it would have passed more under the radar than something like a backdoor. I do not know how things are reviewed before being pushed to release though.

Not really, not only because of the language but also because the same scrutiny between code and content wouldn't have to be the same. I also don't expect core aspects of the distribution, e.g kernel, package manager, cryptography libraries, to be verified the same way than a random software, e.g Kdenlive. So... is it bad, absolutely. Does it mean everything should be questioned again? Probably not.

I'm sure more people know C or Python than Ukrainian at Canonical. It looks like this particular change has been authorized by a third-party localization project, though I'm not sure the whole process works.

Translations are not going to be analyzed as thoroughly as code, and this was still found quite quickly. Submitted code is analyzed much more thoroughly, often by multiple members or the project.

It is very concerning, absolutely. With that said, it's entirely possible localization/translation reviews work differently than code reviews.

Well but they DID notice

Most translations are contributed by external users for languages that the project developers don't speak themselves, so they can't always check everything unless there's multiple active translators for one language.