I don't think the filtering they mention for security actually works? Anybody who clones a repo on GitHub can make their own commits appear under the original o

I don't think the filtering they mention for security actually works? Anybody who clones a repo on GitHub can make their own commits appear under the original org url when accessed by ref.