> If this is not desired behavior it should be enforced by requiring a reviewer to sign off on the changes before merging.

From what I've read about this specific incident, it seems this was enabled by the fact that this project had been moved to GitHub Enterprise without the maintainers' knowledge. One of the features of GitHub Enterprise is that some privileged users in the organization can bypass such restrictions. That may be what happened here.