It's always a delicate balance, as there are obviously a fair number of people who don't know what they're doing (yet, if they're learning), as well as some mal

It's always a delicate balance, as there are obviously a fair number of people who don't know what they're doing (yet, if they're learning), as well as some malicious people. There are ways to deal with that, e.g. force small patches that solve well-identified problems; use CI to test; involve projects' users in testing; and above all, to have other maintainers in the project who can catch such behavior and help you fix it. By yourself, you're rather vulnerable. Ideally you have a core of 2-4 people you trust from previous projects, and then you can bring unknown people in little by little. There is no tradeoff as such, but you do need to be more sophisticated than "here are full commit rights."