I imagine it's because the GH Security team are responsible for the security of GH itself, not the million crappy repositories hosted there.

Rather, they ensure that the repos that are malware can't compromise GH's infrastructure and other repositories.