As far as I recall the vendor of the repository patched the exploited vulnerability, so that checks out.

Considering that there would be no clear benefit to such criminal behavior, in my opinion "unlikely" is putting it mildly.