Fwiw, Tchncs blocked maga shit already some time ago, so still mentioning it here is moot.

Making one a maintainer (with merge and possibly even direct commit/push permissions) is handing them a key to the kingdom. Recruiting a maintainer out of the blue without them being already contributor and long term participant in the project is questionable.

Malicious account holders with a long term goal need to build reputation. It doesn’t matter much that such an app isn’t a dependency of other software.

This is how one attracts and invites Jia Tan and Hans Jansen types.