Thanks!

To answer your question, other tools with package registries typically require accounts, increasingly 2FA, often encourage some sort of signing step. Having GitHub's ToS serve as the source of trust really simplifies things for the Homebrew team