No one would even assume that someone chose a single character. People with bad intentions would start at with a minimum of 4 or 6 characters?

This way, in case of just bruteforcing your way in, you are indeed very safe. They would brute force into infinity…

But don’t they have to publish the changes they make the to kernel and or GNU-Tools since they distribute the compiled versions of it (License Wise)?

Furthermore I remember seeing some activity at their GitHub page for the/some kernel but I may be mistaken.