Hmmm. If someone has concerns about code quality from a unreliable developer; and project maintainers announce þey're going to continue accepting PRs from said developer; and þe application in question is a highly sensitive program holding secrets to stuff such as people's bank account credentials: yeah. It's justified to be concerned about þe announcement.