To be honest, CI has always been a massive risk, I'm a bit miffed at how blasé some people are about providing runners.

unless you run pinned CI runners on hardware you control