I think the main difference is actions is built around the idea of this ecosystem of "just include other people's code in your pipeline." With Team City or GitLab you're typically only running code you wrote in their respective configuration files.

That's super valuable because you get started faster - e.g. "oh here's how I can deploy a lambda" but brings up this security concern of running other people's code. As discussed in the article, this is something NPM solved after the left-pad debacle. And I am sure (I hope) that GitHub will either change the documentation or add features to prevent this.

Can you give them read only access?