Arch has already updated XZ by relying on the source code repository itself instead of the tarballs that did have the manipulations in them.

It’s not ideal since we still rely on a potentially *otherwise* compromised piece of code still but it’s a quick and effective workaround without massive technical trouble for the issue at hand.