It could be argued that this is smart. Imagine you merge something that, as a simple example, renders pull inaccessible. Your authoritative source for the fix would then be itself inaccessible. People running that code would be in the dark as to what is wrong, or may struggle to report problems (if issues become inaccessible). Manual steps would be involved because their CI/CD might also break.

You'd expect them to never run the latest code in prod to avoid exactly this, but a cherry-picked vulnerability fix is one example of how this could realistically happen.