I think shutting down password auth is a mistake, especially if you look at MS services and where they stand now. Authenticating against their Graph API is such a hassle that we just skipped its inclusion in some of our projects because we just don't have the dev time available for allocation.

While it is fine to require better auth, it should be in the hands of users. Otherwise adoption is severely endangered.

That said, Github is an extremely juicy target for someone trying to inject code in a lot of codebases without anyone noticing. So popular repos should certainly make use of it.