The XZ attack is a backdoor that reminds us our biggest open-source security threats are from decades of unlearned lessons.