According to the workflow file, you’re using self-hosted runners…

This is common. Sometimes a security policy works (e.g. a password length requirement may cause people to come up with stronger password) and sometimes people consider it excessive and prefer to work around it (e.g. a password length requirement may cause people to write the password down on a sticky note and attach it to the computer screen).

This costs money, requires some agreement signing and can "dox" developers, so not everyone wants a cert.