[nine_k]

> it's public, after all, so i had the expectation that all info on there is insecure

I think it's a misconception.

Unless you just let everyone write anything in your repo, one would expect that what is there is what it says on the tin.

Every public software project takes measures to stay authentic and not let random and unreviewed, potentially malicious bits in. This is how they keep their users' trust.

Very roughly, "public" = read access is unrestricted, and "insecure" = write access is unrestricted.