The repo owner was stupid for not checking what they were merging, and the author is stupid for making the pull request in the first place. If they wanted to prove a point, they should have merged something a little less harmful, like "echo This file could have deleted your home folder. Don't run random scripts from the Internet without inspecting them first."