Yeah, it's always possible. Just yesterday someone spammed several GIMP merge requests (and apparently a bunch of GNOME apps as well) with AI-generated merge requests.
GNOME apparently deleted their entire GitLab account in response. I'd never seen a merge request completely completely disappear before!