When it creates a PR it creates a branch which requires write. Maybe it could offer the option to create a fork instead, but that would add awkwardness and fric

When it creates a PR it creates a branch which requires write. Maybe it could offer the option to create a fork instead, but that would add awkwardness and friction just to satisfy a very small set of overly paranoid users. If you don't trust GitHub not to modify your code why are you using GitHub as a host in the first place.