Forking and typosquatting. If, for example, Google is famous for HIRING.md and someone squats The username Goog1e with their own nefarious HIRING.md, it seems like a great vector for phishing.

Hiring scams are increasingly common since the pandemic, as far as I can personally gather from linkedin.