For some badges, it is indeed easy to cheat. However, for badges like merging a PR into a repository with 10k or 100k stars, it's much harder to spoof

Edit: same for badges related to creating a repo that reaches x amount of stars and helpful comments on issues