It gets more complicated when commit signing, the widely broken web of trust (for the signing key) and similar are involved.

And not all devs want or need anonymity on github.

In general just because information is publicly accessible in some form doesn't make it okay or legal to abuse it (accessible doesn't mean any form of usage rights are transferred to you weather it's in context of GDPR or in context of copy right).