Ask HN: How bad is the xz hack?

I've been avidly reading all I can about it. I understand how it came about, and my sympathy is firmly with the maintainer. I know research is on going as I type this, but is anyone with the expertise I don't have able to explain in simple terms how bad it is, or could have been?