It is concerning (although not surprising, I suppose) that they wouldn't have the option enabled to make it so that new contributors' PRs won't run github actio

It is concerning (although not surprising, I suppose) that they wouldn't have the option enabled to make it so that new contributors' PRs won't run github actions without approval.. although I guess without further detail on exactly what happened it is possible they do and someone who previously contributed did it which would've made that mitigation useless