I know the standard answer to this is that it would exclude some repos (ex: node) that merge PRs manually via git. However:
1. You already are excluding every open source project not on GitHub, so this is a really weak point.
2. I am extremely confident trading off not including a very small subset of repos for removing the incentive to spam bad PRs is a worthwhile trade.