Build servers being compromised and used to inject malware into trusted, signed binaries is a thing that happens. Being one of the most well known tools in the entire Windows ecosystem makes WinRAR a particularly juicy target for trying to pull that off.