The xz attack proves that Debian is a big target though.