The unauthorised access to a security company's code repository, revealed in the period, carries severity stemming from a characteristic of the product itself: security tools run with elevated privilege.
The reason is functional. To detect suspicious behaviour, the program needs to see what other programs do, read files that aren't its own and intercept communications. That requires permission almost no other software has.
That same permission turns the component into a privileged point of failure. A vulnerability in a text editor compromises the editor; a vulnerability in a security tool compromises the whole machine, and it's installed across tens of thousands of organisations.
Having the source code changes the economics for anyone hunting that flaw. Auditing code is far more efficient than testing the product from outside, cutting the time to find something usable from months to days.
For anyone buying security, the conclusion isn't to stop using such tools, but to treat them as what they are: the most privileged dependency in the estate, deserving alert monitoring, patch timelines and a plan for the day the tool itself is the problem.