The XZ incident would have been so much worse if it would have involved a collision, pushing one object variant to github.com, and one variant to git.tukaani.org.
Then you would have security researchers making conflicting claims depending on which repository they first pulled from, even though they are on the same git commit hash.
Then you would have security researchers making conflicting claims depending on which repository they first pulled from, even though they are on the same git commit hash.