After the xz debacle, I think we should resist the temptation to rush maintainers into accepting code that they don’t fully understand.

Eh, I still think it’s worth calling out sloppy practices like this. At a minimum, drawing attention to it is a way to socialize good practices for others and to spark discussions (like this one!) Nobody is saying this person shouldn’t be putting code out there, they’re just pointing out some pretty gnarly code hygiene. One could argue this is actually one of the main strengths of open source development! Consider the parallel of somebody giving away free food- if they are using unsafe practices like not keeping things at proper temperatures or picking their nose while handling food, there’s nothing wrong with critiquing them, even if their intentions are good.