There are also plenty more ways for it get compromised which don't involve the owner handing over anything - say simply accepting a merge which adds a cool feature while still compromising the other users of the project. Github still gets the same marginal image impact risk because ultimately the security of billions of dollars or X% of a country's GDP isn't protected by requiring a hobby developer to 2FA their afternoon code changes. You can't make them interested in protecting your billions via secure account login. Instead it's done by the billion dollar companies or countries themselves because they are the only ones with resources large enough to protect that much asset in a useful way. All this ignoring the same impact can be had by the author simply having a mistake and not fixing it over holiday vacation, no malicious actors required in the first place.