These threat actors bypassed initial security screening from Valve which allowed the deployment of malicious patches and infected multiple users of the platform.

Good call! Considering the initial safety check they do before approval this seems like the easiest way for it to happen