It doesn't mean you just click 'merge' on every request without ever looking at the code, just that you don't kick back to the submitter with a pile of extra wo

It doesn't mean you just click 'merge' on every request without ever looking at the code, just that you don't kick back to the submitter with a pile of extra work to do before you accept a bona-fide effort. (I don't think there's been any case of an open policy here causing a supply-chain attack)