Then it's up to the consumer to judge that themselves. One component of the liblzma backdoor was that distros were already linking to those tarballs. That wouldn't happen here as the repo will essentially freeze.