I am not sure about that.

Which gate is easier to maintain?

1. Check issues for malicious intent

2. Check PR for malicious intent.

I think in PR requests it is easier to introduce purposeful bugs or obfuscated code than it is to hide them in issues.

So I think gating on issues is easier and more secure.