I mean, running outdated software is bad practice. Do you think backdoors would have to be cleverly hidden every time, like what we almost got with XZ? If it is in plain sight, I highly doubt a person outside of the oppressed jurisdictions (or just someone anonymous) wouldn't make a malware-removing fork.