Note that PRs are mandatory if a company goes through SOC-2 or any other compliance framework. The underlying question they answer is “could a malicious or incompetent employee send bad code to production without another engineer viewing it first?”

The specific response auditors expect is “no, because another human reviews all change requests before they’re approved”.