It's a thing called Open Source, and they're not a company, it's an organisation (a none-profit, The Godot Foundation.)

The point of Open Source is and always has been that anyone can look at the code, and anyone can contribute.

Though the point of a Pull Request is that it's a request, that the people leading the project can simply go "ha, no", or "close, can you change this bit here first though?"

This hasn't been a problem for the last 60 years of Open Source computing, which includes such things as Chromium (the backbone of Chrome), Linux (the backbone of 95% of the internet) and others, because the volume of requests has always been manageable, but LLMs suddenly has made it so it's possible to send poor quality untested and/or broken slop code at high volume.