They know how much time and resources a typical ci run for the project is going to take, so why not limit pull requests from new users to that time, and ask the maintainer to manually approve only if that time is exceeded? This way most of normal users will not notice any change, and miners won't have enough time to cause harm.