You do remember the xz-utils backdoor was found in Sid right?

https://en.wikipedia.org/wiki/XZ_Utils_backdoor