Because the cost in reputation is not high enough to justify a large scale scam operation?

If you don't trust the maintainer, you can always fork a repo and let them merge on their own.