As always, hundreds watch the open repositories, maybe one watches a company's build servers, if they're lucky. :-)

Hundreds watch, but how closely?

Plenty of stories of fairly major projects having evil commits snuck in that remain for months.