I believe it's the rights assignment that should raise the "a rug pull is inevitable" alarm, not the corporate part

There are plenty of corporate projects that don't require rights assignment to submit changes, just a DCO or even just $(git commit -s)