I don't buy that at all. A core developer producing a thousand line commit that they'll be responsible for over the remaining lifetime of the project is entirely different from a fire-and-forget PR from an outside contributor.
If the commit was prompted by a core developer, the developer knows what the prompt was. If it was prompted by a stranger, the core developer reviewing it does not know what the prompt was. The review attention required is completely different, because with an untrusted submitter you have to meticulously hunt down intentional security vulnerabilities obfuscated in the PR.