smithofsmiths

The problem is that the title implies that it's somehow the fault of the package. That's it, that's the problem; the title is disingenuous in its claim.

"Ten days later, Apple Image Viewer on macOS still trusts the compromised eMudhra certificates" doesn't sound as catchy, but is equally correct because the apps use system CA.

The discussion is not about ownership of the code, that doesn't interest the people who have written the policy in question.

"Assisted" does not necessarily mean "authored", which is the point of the comment you're replying to; helping you review the code is "assistance", even if no code was written.

Curiously, https://github.com/qgis/QGIS-Enhancement-Proposals/pull/387#... shows that at least some contributors realize the vagueness of the policy, but they don't seem to care, which is rather unfortunate.