Relying on maintainers to always do the right thing to ensure our security by telling them what to do is not the way.
They're not useless. They just don't work on the individual level but on the collective. It's a numbers game …
The advice is actionable because it is a concrete change that could be made. I believe it to be relevant to the context because someone in a position of authority who is badgered into accepting something would most likely benefit from reevaluating how he is interacting with the general public.
A lot of people don't want to be responsible for that. It's not fun to carry that weight.
How is it not actionable? "Hey, you seem keen on feature X but I don't care about that. Just maintain X in your own fork. Thanks!" -> Close issue / PR.
Is this an illegal move? I've done it plenty of times. And other people have said the same to me, too!