"In other news, we just learned that any half-decent security agency has already injected their own vulnerabilities and back-doors in OSS."

We did not learn that today, but we still assume it.

Btw. the professional agencies have their vulnerabilities injected probably way down in hardware level. Intel ME etc. and or even more bare to the metal.