Comment by skeledrew

I don't see how that applies here. In that case it's 2+ potentially compromised things working in tandem to propagate the malicious effect. In this case I'd think someone reverse engineering a compiler to see if it's compromised would ensure their tools are clean enough (use known clean sources or build their own). And if there's no way to ensure a minimal cleanness then the world is already irrecoverably lost.