It's the job of the people maintaining the project to review changes they merge in and to understand them. When people make PRs to my projects, I don't just trust them blindly.