As far as I can tell, The Harris/Walz campaign hasn't officially responded to this endorsement. Are you getting mad about stuff that hasn't even happened?
Believe it or not, the Harris/Walz campaign doesn't orchestrate endorsements. Anyone can endorse a candidate with or without that candidate's knowledge, permission, or acknowledgement.
Harris may be getting the endorsement of old-school/moderate Republicans, but Trump has the endorsement of extremist/far-right Republicans and Neo-Nazis.
If you can't pick a side here, that's entirely your own moral failure.
Anyone who wants to fix this can help fix it, but people are just making demands of an unpaid maintainer. The devs can run this project the way they want to. If you don't like it, don't use Ventoy.
The people comparing this to the xz exploit are out of line. xz was a library that was deeply embedded in a lot of software. Ventoy is an IT tool used to boot live OSes. Not even remotely the same attack surface.
Blobs in the source tree are not ideal, but people need to pick their battles.