Also suppose you Facebook account was compromised, that bad, sad for the person affected. May cause some media attention if the person was famous.

But if the right GitHub account is compromised, we could see massive supply chain issues. Or a big important web service with millions of users affected.

The downside of making a wrong call here is just really really big.

There are real businesses being deployed from GitHub.