What I mean is that making fake author accounts and then merging with an authenticated account shouldn’t help a malicious actor. Any competent project will be interested in the accounts contributing.

Maybe my org is just simple but if “John Doe” started submitting pull requests and prepend merged them, it’s me on the hook and there are people interested in who John Doe is. And in my org, even John Doe needs a network credential so even their local git instance (which I’ve never seen anyone use) would need a credential.