[Stierlitz]

"So how do we guard against this type of attack?"

Don't allow access to your 'secret' source code from the open Internet.

[m4rtink]

Or actually do that and let everyone verify and build their own binaries. This is preatty much how Linux distros work, the multiple third party distro packagers packaging upstream code make it preatty hard to sneak in mallware unnoticed and almost impossible to affect multiple distros at once.

In comparison proprietary software companies are a single point of failure where customers can't access the source and have no means to verify what ghe binaries they get actually contain.