> Because GitHub fails to distinguish between fork and non-fork SHA references, forks can bypass security settings on GitHub Actions that would otherwise restrict actions to only “trusted” sources (such as GitHub themselves or the repository’s own organization).

How is this not resolved?

Easily bypassing security controls is a major security issue.

Yes, you need to convince someone to use your SHA, but social engineering is usually the easy part.