Assuming you've compromised said developers account, wouldn't you be able to click that publish button too?