You don't trust Github to not host any malware, and you don't trust Github to not have malicious users. You trust Github to have reasonably good security, and

You don't trust Github to not host any malware, and you don't trust Github to not have malicious users. You trust Github to have reasonably good security, and to not maliciously meddle with user content, so that if you see a repository under github.com/neovim, and you additionally trust the user called neovim, then you can reasonably trust that any repositories under github.com/neovim don't contain malware.