And that is fine; until an malicious actor pushes a PR of "add a botnet that connects to an IRC CnC" somewhere in to the code.