I am an Israeli, and I agree with you. I just wanted to point out that trying to speculate a ___location for the attacker based on what days they worked isn't going to be remotely accurate

Speaking of innacurate things, since the actual XZ git.repository isn't hosted on GitHub, could there be logs of which IP address the attacker was operating from?