We used to use completely separate tools for code review (in our case because the process was older than git). Some of them might be doing something similar.

Startups hack things in to production?

Shocked, I tell you.

IME some people (at least the ones who care) start more critical repos with good intentions, enabling most of these things.

But then comes a time where a hotfix must be merged asap to production and there's no one to review it for 3 days; branch protection gets disabled.

or an update in the code quality tooling detects an additional dozen warnings without the codebase changing; check enforcement gets disabled.

I think in most cases this is completely fine. Whoever is already a contributor should know what's the team policy merging things, and having ways to occasionally bypass these checks can be more beneficial than not.

Okay, now check whether anybody actually reads TOS when they check the box that says they did.

I suspect many don't enforce it via GitHub functionality, but do implicitly require or recommend reviews.

How many contributors do these projects have? All multiple active?

That is... shoddy. This is basic stuff.

Why would you do that?

Because you hate yourself?

Oh, right, you found a tool (self reflect) that let's you do it with zero effort. FU..