That's the thing: they do bear responsibility in allowing the situation to get to this point and are very pointedly not connecting the dots with their response.
Microsoft which owns GitHub, has been washing their hands if any responsibility in helping to resolve the ongoing supply chain catastrophe which is hosted and spread nearly entirely via Github repositories: not responding to security researchers flagging malware hosted on GitHub; doing nothing to address the proliferation of open source malware across their platform, giving no recourse for action, not applying their tremendous resources to the problem, fiddling as the open source community burns and leaving the devs to fend for themselves. Let's not mention the recent very hostile and trust-erodibg behavior towards bug bounty security researchers.
The *&$@ finally spread all the way up to the top of the hill in a compromise of Microsoft's own repos, which I think highlights the scale of the problem.
And in response, they offer a watery corporate platitude, "a few customers were affected in a recent incident, and we're looking into it."
This is, with no intended disespect, both absolutely false and dangerously blithely ignorant.
Unfortunately most of the population (including medical doctors) also has a similarly nonchalant conception of mold; that it's something that merely causes some allergies and sniffles for sensitive members of the population.
Toxic mold secretes _neurotoxins_ which will 100% destroy your life for years, if you get a bad enough exposure.
Read some of the experiences of mold survivors in this thread or elsewhere to get a sense of how bad this can be: it's horror-movie stuff.
Source: been through mold exposure myself. It wrecked my life for 5 years, and I still have lingering aftereffects.