Currently the explanation that fits the situation best: One of the two maintainer accounts of xz acted as a bad actor. It is unclear whether there’s an actual person behind that account, so further speculation regarding motifs doesn’t make sense.