This could be guarded against by adding a second condition to the actor check, but who would do that prior to reading this writeup? I'd seen the referenced GitHub actions abuse article but had no idea it would be so plausible - usually I roll my eyes at the real-world requirements to take advantage of some 0 day exploits, like physical access to the cpu for heart bleed I think it was.