Link to the source blog entry. It has more information on how the malware went undetected and how it worked.

Real talk, Pop_OS! is just nice. Besides Blackbox and like 3 Gnome Extensions I hadn’t had to change or add anything. It’s a great experience and I recommend it to everyone.

Broken link? This seems to be a more or less up-to-date roadmap for Thunderbird on Android: https://developer.thunderbird.net/planning/android-roadmap

Self hosting your own CI/CD is the key for OP. Littering is solved too because litter is only a problem on long running servers, which is an anti-pattern in a CI/CD environment.