Out of principle I'd too suggest to avoid executing a compromised program, strings /bin/xz | grep 'XZ Utils.* [0-9]' for example is not so dense.

@muru, in principle I agree with your argument, but the chance of the system having executed xz after the evil version was installed is pretty high, so xz --version would be just one more drop in the bucket. And one couldn't consider even updating to an unaffected version, because the package is provided as a .tar.xz that needs will be unpacked with the affected xz, and Debian itself urged the users to update the package instead of wiping the system, so...