I'm a big critic of MS and Github is just-another-acquisition to them to monetize users. To that end, the permission to allow a third party to engage in bannable behavior, using someone else's account, is promoting bad actors. MS has lots of experience with this and it will likely be addressed (prohibited outright) in the future. Too late for some.

Any site you grant this permission to could abuse it. The abuse is on the abuser, not the person granting permissions. Allowing the abusive behavior to happen at all - authorized or not - is on Github.

You can't put all the blame on the user, when GitHub makes the page where you just log in to a third party and where you grant them permissions look so similar.