But that's a check for a Linux feature. So the more interesting question would be, what in the Linux world might be building xz-utils with cmake, I guess using ExternalProject_Add or something similar.

Yes this is Linux.

At this time we don't know exactly how much is affected and what originally drew the attention of the attacker(s).