@scy Ah, ok, in theory you are right.
But #xz has been executed many times since / if it was installed on our systems.
Not executing it now may feel good, but it does not make a difference, it’s still the same software that was executed a day ago, before we knew.
If I don’t execute it now for fear of some nefarious activity I must expect that this activity already happened.
So avoiding to execute it today only makes sense if I am about to reimage the system from scratch, immediately.