No different in action that all the major companies and governments putting in backdoor stuff for various purposes. The only saving grace is that it is readable code here, but is the fact it wasn't found early on the fault the person who wrote it, or the community that didn't see it?

Would people have used it if it was commented and documented on its purpose? That should tell you something. And if you say yes, that should tell you something as well on how much you want to defend this.

All the drama and stuff beyond this was wrong. But this is core of open source, to make sure code is valid and honest and to call out bugs and maliciousness. Are the people who found and reported it responsible for others' actions after they were pissed about it? Of course not. Doesn't make things beyond dropping the use of it okay, but hey, consequences. Maybe don't do things behind people's back.