You can't avoid having to have binary blobs of data. And again, GP was talking about closed-source drivers, not specifically the xz attack.