This is something we have noticed as well in our supply-chain security analysis of Github repos. It could be "build it in the open" philosophy as well that offers complete transparency and security audibility.