These days getting commit rights to inject malware into an already popular gem has become a real threat.

In 2016 I think it wasn't yet/wasn't recognized.

I am very sympathetic to the suggestion in OP prior to recognizing that there may be people actually actively trying to abuse your trust to intentionally inject malware.