I won't argue with you about open source malware. I got some from GitHub in the past. There were a lot of complicated build steps that involved downloading mysterious "dependencies", which is one reason I don't like package managers.
With regards to first and last names, Git allows changing history. GitHub lacks a high-level interface that would go through and change names for Git commits across different repositories. I don't know how much work a feature like that would require, but it could probably be done with a script and added to Gitea/Gogs/etc.
I have never used Tor email, but I would assume that it would be
user@domain.onion. I believe Git checks for the presence of the @ symbol in the email field, but beyond that AFAIK GitHub doesn't filter email addresses in commits. I have put just the @ symbol in the past and it works fine. If GitHub doesn't allow a Tor email address linked to an account (for contribution tracking that goes beyond raw Git), that's probably a case of their email server lacking an onion router, and they could add that if enough people requested it.
In summary, GitHub is just the lowest common denominator Git host that barely adds anything on top of Git. Git itself doesn't do a whole lot. Now that MS owns GitHub they're not going to put in any more work than they have to (unless it involves money, like with project sponsorship, in which case MS gets a boner).