The XZ Utils backdoor, discovered last week, and the Heartbleed security vulnerability ten years ago, share the same ultimate root cause. Both of them, and in fact all critical infrastructure open source projects, should be fixed with the same solution: ensure baseline funding for proper open source maintenance.
No, they do not have the same root cause. Heartbleed was an apparent typo from a known figure missed in a code review. xz was a sustained effort of external pressure to get an anonymous person access to add obfuscated code that would probably not be reviewed, and even if reviewed would probably pass.