What could the xz backdoor accomplish?

I've been remembering the XZ episode after watching the veritasium video, and not being a big networks guy, one thing can't leave my mind: what could actually be accomplished?

It seems to me like Jia (or whomever) would still need a way to penetrate mostly private networks. I mean, who leaves their ssh port open to the public internet?

So the discussion I think I would like to have, or to have someone clarify to me is: OK, Jia got the backdoor in the target server. Is it not correct that he still needs to penetrate the network, which seems to me like maybe an even bigger task?