“the lesson *I'm* choosing to take from xz, as an oss maintainer, is that anyone trying to pressure or guilt me into doing something should immediately be told no, for security reasons”

Bad code, yes, calling it 'shit', no.

Stuff like this is a big part of why software circles are seen as so hostile and unwelcoming to outsiders.

You can be completely clear and frank without resorting to insult, mild though it may be. Just because you and people most like you understand that calling their work 'shit' doesn't reflect on them personally, doesn't mean it's not significantly exclusionary.

Now, obviously you can get to know your reports well enough to understand whom would take 'shit' well, but that doesn't mean it's not generally important to temper criticism with kindness. Kindness never has to mean holding back criticism, just avoiding stooping to insult.