I think it's a vuln to think of OSS in terms of 'a community'. It's an abstract thought construct that does not represent reality (though it helps to make sense of it in a rather specific manner) xz happened because of the absence of community. It could happen inside this abstract thought of a community as well but here it did not.

xz targeted deb and rpm. The vast majority of what is facing the world.

Nix did not stop it.

I believe this article feeds the possible vuln rather than prevent it.