> People just aren't auditing random code on github for fun

Yes, they do: https://www.fsf.org/blogs/community/who-actually-reads-the-c...