On: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

[fragmede]

specifically, thevCFAA covers distribution of malicious software without the owners consent. Security researchs downloading malware implicitly give consent to be downloading malware marked as such.