TL;DR there was a backdoor found in the XZ program. All major distros have been updated but it is recommended that you do a fresh install on systems that are exposed to the internet and that had the bad version of the program. Only upstream distros were affected.
You can have a nefarious developer working for a nation state infiltrate the supply chain for ANY OS.
You don’t know.
Agreed