xz didn't get hacked (phished).

For xz an advanced persistent threat, inserted hypertargeted self modifying code into a tarball.

A single npm dev was "hacked" (phished) by a moderate effort, (presumably drive by) crypto thief.

I have no idea what you meant by "right inside _ssh_" but I don't think that's a good description of what actually happened in any possible case.

I'm unlikely to defend C devel practices but this doesn't feel like an indictment of C, if anything the NPM ecosystem looks worse by this comparison. Especially considering the comment you replied to was advocating for minimizing dependencies, which if the distros effected by xz being compromised had followed, (instead of patching sshd) they wouldn't have shipped a compromised version.