why only bower-dependent?

I'm guessing the parent doesn't mean only bower, but bower uses github as the source of packages/code (I don't use bower, so I'm only going from memory). On a build that downloads everything 'fresh' it's not going to be able to get sources that are only on github.

Bower certainly isn't the only thing that does it. It's a trend that's becoming more and more common.

I was in a go tutorial a couple of years ago where the presenter was including directly from github.

And sitting in a ruby talk when the rubygems compromise happened just after everyone had been told to go upgrade a gem because of flaws in a specific gem.

It's not unique, but it is terrible.

Unlike most other package managers, bower doesn't actually host packages. It just finds that at Git URLs, which are almost invariably on GitHub.