We still have not the right sandbox and PR abstractions to make the merge of the two complete. Imagine merging a PR and knowing exactly this code cannot ever possibly reach the internet and it can only receive and send specific shapes of api requests from these specific services, it has well defined resource limits and you have specific optimal UI to review these constraints. I can imagine to not review a bigger number of PRs in that reality.