If you have malware on your CI machine it can infect the artifacts it creates.

> Ken Thompson's trusting-trust attack [...] is widely regarded as a threat specific to compilers. We show that it is not

And yet, from Reflections On Trusting Trust:

> In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode.

The paper is certainly a nice worked-out example of the attack, which is worthwhile, but it's not novel.