For the record: GitHub has implemented disabling of PRs on a repo[0] and as a result we have done that and opened up the test repo, making the aforementioned test results[1] public.
So, uh, good job GitHub! Shame it took you ten years, but better late than never.
There is an intermediate step between full off and full on which is "collaborators only". It's not clear who that covers: if it was project members only that would be a useful addition to the test process, but if it includes the rando that sent a one line typo fix to the main repo 3 years ago, not so much.
[0] https://github.blog/open-source/maintainers/welcome-to-the-eternal-september-of-open-source-heres-what-we-plan-to-do-for-maintainers/
[1] https://github.com/openssh/openssh-portable-selfhosted/actions