I think the main issue here is that the access point for many OSS projects most of the time is package managers.
People often aren’t hitting up GitHub directly to get or install open source projects: they’re going via homebrew, npm, or whatever, so the registry becomes the source. Of course you can install directly from GitHub even with package managers but most times you don’t and it’s increasingly seen as a security issue.
On your second point, ugh, yes, you’re absolutely right. I don’t think it would work exactly the way you describe but, if there’s some automated revenue sharing/distribution, you can bet that people will find ways to exploit it via some form of spamming.
You're right. Blanket rate limits probably aren't a good way to handle the traffic profile of places git services.
Package managers tend to only need a small portion of what's in any given repo; some metadata to figure out what's going on and a single binary package is generally enough. The obvious answer is to separate those out and serve them differently from developers, who are actually monkeying around with the source code.