Lots of software links both liblzma and libcrypto. As I read Andres Freund's report, there is still a lot of uncertainty:

"There's lots of stuff I have not analyzed and most of what I observed is purely from observation rather than exhaustively analyzing the backdoor code."

"There are other checks I have not fully traced."