@anemone @icedquinn It is a statement of community intent and it is enforceable to an extent, particularly with modern code versioning tools allowing for retroactive correction when an individual is found to be compromised.
The very same thing would apply if a dev was found to have been compromised by feds (or blackbagged and their computer taken over) or something similar.