Comment by AnBouch

Approval is not mandatory for all PRs. You can change your policy about it and easily justify it with your auditor. => It makes way more sense to have important stuff reviewed vs automated approval from a bot.