If this had been closed source, the attacker would not have been able to use the technique to commit the changes in the first place.

No need for speculation we have such a real equivalent.

The SolarWinds Cyberattack Explained: Hack, Victims, and Key Facts

Both are supply chain attacks and the proprietary world let it go farther. They both highlight vulnerabilities. There are going to be small and important FOSS projects that have burnt out maintainers, and possibly few eyes on. In principal someone should be getting paid to keep things safe in closed land, but security is a cost center and an easy cut for the MBAs in charge of things.