>It also seems weird that people are only scanning code that breaks?

That's how the xz exploit was caught.