> If one thing can be gotten from that incident is forcing GitHub to create finer OAuth scopes and per repository.

This. Limiting OAuth app access to specific repositories. I really wish this was a thing. For this exact reason I'm creating a new GitHub account for every new integration and share the repo with this account. It's technically against the TOS (they only allow single bot account per user) but there is no other way if you want security.

Maybe GitHub will implement this feature now. My hopes are high.