Open source contributions can't be faked (except by real name collision), and in any case, there is much more detail available than a few lines or bullet points in a resume.
They can perform similar tactics on github: like mirroring an obscure but technically in-depth project without attribution, paying someone to write code and then committing it in your name (I've seen this done!), or making sure to get lots of extra commit density by doing one feature or bugfix after successfully landing a series of reformatting PRs.
An applicant planning to fake their way past you is genuinely hard to catch unless your process is tuned for it. The idea that there is a one-size-fits all interview process and that process is as simple as, "Check their github" is lazy to the point of malpractice. It's a goofy premise, and it's playing right into the hand of people who want to abuse you.
And this is just addressing the problematic nature of modern tooling for positive signals. Given the pervasive nature of harassment culture in the open source world, you should ALWAYS excuse the absence of open source work. It cannot be a requirement because the open source world can often become extremely hostile and/or political.