It absolutely could. Heck, RPMs and DEBs pulled from random sites can do the exact same thing as well. Even source code can hide something if not checked. There's even a very famous hack presented by Ken Thompson in 1984 that really speaks to the underlying thing, "what is trust?"
And that's really what this gets into. The means of delivery change as the years go by, but the underlying principal of trust is the thing that stays the same. In general, Canonical does review somewhat apps published to snapcraft. However, that review does not mean you are protected and this is very clearly indicated within the TOS.
14.1 Your use of the Snap Store is at your sole risk
So yeah, don't load up software you, yourself, cannot review. But also at the same time, there's a whole thing of trust here that's going to need to be reviewed. Not, "Oh you can never trust Canonical ever again!" But a pretty straightforward systematic review of that trust:
- How did this happen?
- Where was this missed in the review?
- How can we prevent this particular thing that allowed this to happen in the future?
- How do we indicate this to the users?
- How do we empower them to verify that such has been done by Canonical?
No one should take this as "this is why you shouldn't trust Ubuntu!" Because as you and others have said, this could happen to anyone. This should be taken as a call for Canonical to review how they put things on snapcraft and what they can do to ensure users have all the tools so that they can ensure "at least for this specific issue" doesn't happen again. We cannot prevent every attack, but we can do our best to prevent repeating the same attack.
It's all about building trust. And yeah, Flathub and AppImageHub can, and should, take a lesson from this to preemptively prevent this kind of thing from happening there. I know there's a propensity to wag the finger in the distro wars, tribalism runs deep, but anything like this should be looked as an opportunity to review that very important aspect of "trust" by all. It's one of the reasons open source is very important, so that we can all openly learn from each other.
I just want to note here for those about to journey into this conversation, there's a major hiccup that didn't exist before. The Supreme Court placed an new expansive interpretation of the Second Amendment in the 2008 Heller case. This has significantly altered how the second amendment is read in the United States. So what may seem like "brain dead easy" things to do, likely cannot be done as they would be unconstitutional.
I say this because the question posed simply indicates "Present + Congress" which seems to imply, "which laws would you pass to fix gun control issues" and post-2008 that is no longer a thing. Any discussion needs to include at this point a conversation about the Supreme Court, the new understanding of the 2nd Amendment, and that the Justices currently on the bench will likely enforce their new expansive interpretation for their term on the court (which is a lifetime appointment).
We are now at a point that we cannot fix this issue without a Constitutional Amendment, a reorganization of the Supreme Court (packing, impeachment, etc), an incredibly careful tip-toe around this new understanding of the second amendment, and/or talking about the underlying issues that surround gun reform (economic and societal issues).
And we are seeing the consequences of Heller in things like 2022 Bruen which SCOTUS indicated that a "historic standard" should be applied to new gun regulation. This has lead to US v Rahimi where the Court of Appeals for 5th Circuit has removed the Federal protection that folks charged with domestic violence can still obtain a gun as "domestic violence" had no historical standard on which to base on. Which is an absolute astonishing level of logic there.
We are no longer at a phase where legislation alone along the strict lines of "just gun reform", this new understanding of the second amendment has forever (or at least as long as those Justices sit the bench) altered how we can approach this issue. We cannot just simply say, "let us figure out ways to regulate gun ownership in itself" that is no longer allowed. We can approach the issue indirectly: how do we increase the cost of Interstate gun ownership, how do we regulate the the dissemination of ammunition, how do we address the various issues that draw people into violent crime, how do we address the issue of school shootings at an societal level. But we have been cut off from direct approaches that regulate guns themselves except in the most extreme cases and even then, advocates are continually being handed new tools by the Supreme Court to bring about new challenges for those.
Any meaningful debate about gun control needs to include the Supreme Court. Because given the current Court's propensity to expand gun rights and the understanding of the second amendment, any law that might get introduced to fix the issue today, could and very likely would be overturned by the court. This has become a new chess piece in this game to be considered since 2008, prior yes this could have been a Congress and President issue alone, but post-2008, the Courts must be considered in the discussion. The Supreme Court too strongly embraces the new understanding of the second amendment to let any direct law be allowed to go unchallenged.