Yah, that's a "closed org". When you need to deal with the public at large, you need to deal with user registration issues and spam.

So now every person who wants to contribute to your open source project has to setup a VPN client?

The parent comment was explicitly about non-closed (e.g. private) orgs.