You’re spot on with the latter, I’ve come across a few projects over the years where the ownership is transferred and it’s then loaded up with malware or even just instantly abandoned again because the new owner just wants it on their GitHub to get a job or something.