Deployer has a dedicated WordPress.org user, deployer

Does this mean that if someone malicious obtains the password for that user (it's still, unfortunately, the case that wordpress.org has no two-factor authentication system), then they could push their own updates to every plugin from any author that's in the Deployer system?