The reach of the trojanised extension attack, with thousands of internal repositories compromised, follows less from the technique used and more from a common characteristic of development environments: broad credentials with no expiry.
The arithmetic is direct. Someone working on five projects usually holds, on the same machine, access to all five, plus a cloud key shared by the team and package publishing credentials. Harvesting one machine yields that entire set.
What amplifies it is the absence of expiry. A key created two years ago to solve a one-off problem is rarely revoked, because revoking requires knowing who still depends on it, and that information usually doesn't exist.
The fix isn't expensive and is unpopular because of friction: credentials that expire in hours, scope per project rather than per person, and automatic rotation. Each of those annoys slightly every day and hugely reduces the damage when someone gets in.
The point the incident makes clear is that the developer's machine became the company's most concentrated access asset, and is almost never treated as one.