But the Linus piece is sound

... for Linux

... and developers working for it constantly

the attack wouldn't work. Joe Schmoe? It's worse than just "being compromised"

You have repo of dependency locally, let's assume you downloaded good copy, the commits get compromised, you're safe.... right ?

Nope, if there is build server along the way and ESPECIALLY if it practices building from clean state every time, the build might be infected while your local copy is clean, giving no chance to notice it, unless your entire chain including local builds are reproductible AND you actually check it