“This vulnerability is, as far as I know, the first one to affect almost everything.”
Unicode lets text flip direction mid-line. Drop those control characters into a comment or a string and the code a reviewer reads is not the code the compiler runs. Open source runs on the idea that many eyes catch bad patches. Those eyes just learned they were reading a different program.