That's a good point actually, I suppose it doesn't indeed really matters to them where it goes as long as they can say "we gave X to open source projects", X probably being already defined.
So your hypothesis is that they'd rather assume this potential cost for the sake of publicity ?
Also, in the "paid to sponsor" scenario they'd be hoodwinke into giving money both to someone worthwhile and someone totally unknown to them. I'd be really curious to know the technical or legal possibles responses.
How many sponsoring circles have you detected already ?
I can't believe people able to be sponsored aren't doing background stuff to make sure they get free $5K a month from github, since it's a simple as doing a reciprocal sponsoring.
Heck, anyone with a bit too much cash can just offer to be payed to sponsor, let's say you give me 1 unit, I sponsor 0,9 upon payment, you get 1,8 from github.
TL;DR : really surprised you went with matching sponsoring, aren't you worried about this, is this just cost of doing business, or are you actively detecting it ? (and how if discloseable ?)