The XZ backdoor: What security managers can learn