True. However, hopefully that’s being mitigated through things like not allowing authors to review their own commits, not using the same accounts to push code changes and do deployments (i.e. having a read-only account for deployments), etc.

However, if it were an admin account that were breached that would definitely make it possible to circumvent any number of protections in place.