They could anyway, one person intentionally introduced bugs and the other reports them. The reporter just avoids ever contributing code themself.

But doing any of this repeatedly without getting caught seems hard.