> people getting swindled out of their money by handing it over to strangers.

I think that OP is trying to say is that there is very little reason for a human to go through the trouble of contributing to a "plausible looking fake repo".

To get to the point that a repo starts to attract interest from other contributors, that project needs to have actual utility.

Who in their right mind would jump into opening a PR from projects they never used? And if the project does get used to the point that it attracts people interested in contribute to improve it, wouldn't it mean that we've achieved https://xkcd.com/810 ?