> Still, it's a decent example of blaming the tool for the actions of its users.

They're not really "blaming" the tool though. They're using a supply chain attack against the subset of users they're interested in.