> Isn’t the solution to define a contributor network (eg a GitHub org that you can apply to) based on trust?

Yes but this is fairly tedious people work that most open source maintainers are not interested in. Once the tooling is available to make that easy, it will become more popular.