The xz utils issue very likely included intentional efforts on the state actor to burn them out. That isn't something a culture change among users can fix.