I suppose the risk of a 0-day in the compression format, given we’re in the post-xz-era. Publishing the source code in clear text would alleviate such risk for the consumer