Right, people forget that the xz-utils backdoor happened to a very traditional no-dependencies C project.

xz-utils has a ton of build dependencies. The backdoor implant exploited a flaw in an m4 macro build dep.