Technologist vs. spy: the xz backdoor debate

At the end, it suggests this is a counterintelligence problem. I don't know what the author wants intelligence agencies to do, maybe they could catch some of the more obvious stuff? I worry about an even longer con, where the attacker fully takes over the project and becomes the sole expert on it, making detection by cursory inspection not work, even though it did in this case.