If is a nation state project, then you don't just try to infect one opensource...
If #xz is a nation state project, then you don't just try to infect one opensource project, you attempt to infect dozens. You want to be the bureaucrat that spent 5 man years on a infecting a single open source project and that one failed?
Self-replies
I mean, if you want your project cancelled, that is how you get your funding cancelled.