Only honest commits by good actors are reviewed. Good for QA but useless for security.

Cryptographic signing is not enforced for commits or reviews, so an attacker that controls a single maintainer Github API key could make a PR with a burner account then "review" and merge their own PR. Time it right and bury it in a dependency of a dependency and you are likely to get away with it. Especially considering they also do not do full source bootstrapping or enforce deterministic builds so including random binary-blobs in tree is a-okay and not sus at all.

The fact everyone is not aware of this is exactly why it is going to work, or already has.

I did once propose to the Homebrew community to enforce commit and review signing but they ultimately refused, worrying that asking people to press a button when it blinks would cause too many definitely smart and useful contributors to leave the project.

So instead they chose the honor system, like NPM.