Somebody who was previously active on the kbin codeberg repo has left that to make a fork of kbin called mbin.

repo: https://github.com/MbinOrg/mbin

In the readme it says:

Important: Mbin is focused on what the community wants, pull requests can be merged by any repo member. Discussions take place on Matrix then consensus has to be reached by the community. If approved by the community, no additional reviews are required on the PR. It's built entirely on trust.

As a person who hangs around in repos but isn't a developer that sounds totally insane. Couldn't someone easily slip malicious, or just bad, code in? Like you could just describe one cool feature but make a PR of something totally different. Obviously that could happen to any project at any time but my understanding of "code review" is to at least have some due diligence.

I don't think I would want to use any kind of software with a dev structure like this. Is it a normal way of doing stuff?

Is there something I'm missing that explains how this is not wildly irresponsible?

As for "consensus" every generation must read the classic The Tyranny of Stuctureless. Written about the feminist movement but its wisdom applies to all movements with libertarian (in the positive sense) tendencies. Those who do not are condemned to a life of drama, not liberation.