Not (only) Magento
I've seen many other websites hacked this way, inserting malicious code into the code base, and not only in Magento. And there are many variants: scripts stealing POST data, scripts adding XSS, scripts trying to steal root passwords, scripts allowing incoming calls to process data (for Bitcoin mining, to send spam emails from that server), etc...
In some cases the cause was stolen FTP credentials (by viruses/malware) from a client computer in other cases it used an exploit in the application.
There are many other applications that can provide access to the server via exploits, for example WordPress.
There is only one case where Magento would be to blame and an action from Magento is to be expected and that is: if the exploited application were to be Magento of the latest version and fully patched.
So there's only a slight chance this one highlighted case was caused by a fault in Magento in the first place. That's why you don't hear anything from Magento.
The new thing here is that the inserted code is very specifically targeting Magento and using Magento's code architecture and principles.
What to do
Now to give some answer to your question "What to do against it?"
Never run two different applications on the same server instance
Like WordPress + Magento. Sometime you see WordPress running on as in www.magentoshop.com/blog/ or Magento running on www.wordpresswebsite.com/shop/. Don't do that. Exploits in WordPress can give the attacker access to your Magento data.
Use a Version Control System
I'm using GIT and also have this on the server (read only access) to deploy the website. This also gives me a quick insight in changes on the system by running
Never use FTP, only SFTP, never store passwords
I mentioned above that FTP passwords were stolen from a client computer. Also using FTP is not secure as it will send data unencrypted through the internet. So use SFTP and never store your passwords in your FTP application, just don't be lazy and type them every time when you connect to your server.