The xz backdoor is basically his point in practice — that was a maintainer-trust compromise, not a hash collision.