Yeah, and with the Bitby job there's more detailed information where they got into the laptop via a supply-chain-attack which is kind of like a long-con or long-game.
I covered this a while back about the Arch Linux AUR repository attack earlier this year. I think that was mostly considered a failure, and maybe even a troll of some kind.
But the idea is that you slip malicious code into developer supply-chain repositories that downstream projects rely on, and you hope your malicious code makes it onto a system with credentials that are useful in a serious exploit; like this one.