The Polyfill incident is bad (that seems to be how the hackers got into the internet archive), and the OpenSSH one could have been really nasty, if it wasn’t caught both early, and by chance (a performance engineer at a major software company noticed).
Don’t they famously have an issues with QC? It wasn’t all that long that their other cars had problems with panel gaps, or manufacturing material left inside, etc.