If you actually read his github you would know that there is a different version of the responsible component between the recovery environment and an installation. Only the RE has the issue.

I’ve read the XZ vulnerability. The very same thing can happen in a closed source corporate project. There are many arrests of foreign intelligence agents that worked in big tech amd/government. It would of course be easier to cover up. As would vulnerabilities discovered by ai, since they can limit who can check their code.