Even if you don't have cryptocurrency they can still go after your GitHub credentials and run some very expensive agent and runner workloads.

I've started developing with a separate user account to limit the blast radius but you still need to login to access repos and use AI features.

I suppose it's just the best ROI on using a complex attack vector or spending one or more zero days. But other types of targets may wreak havoc for bystanders that become collateral damage, idk trying to get specific private info on a target may expose data on millions, or anything increasing scope as to hide the real target, etc.