Take a look at the CVEs. People find vulnerabilities in trusted open source projects all the time. The NSA hires a lot of smart people to spend all day looking for them and not share their findings with the Internet.

No infiltration required.