No, probably not. Here's the thing, GitHub integrations always ask the user whether they authorize the integration, they provide the list of permissions that the integration is asking for.
It's not GitHub's fault if the user doesn't read the permissions and authorizes the application.
Yeah but it is GitHub's fault for banning the user instead of the abusive application. You realize the oauth token is connected to the client_id, right?
It's not GitHub's fault if the user doesn't read the permissions and authorizes the application.