If they'd waited a week before using their ill-gotten credentials to update the packages, would they have been detected in that week?

That is what the tj-actions attacker did: https://unit42.paloaltonetworks.com/github-actions-supply-ch...