It't way more work to make a fake profile, with actual contributions to different (real) repositories, then just pretend to be an existing one.

If they want to actually start and collect a few paychecks, then they'll need to pass a background check from HireRight or whoever. This'll probably include transcript checks, verifying past employment, etc.

Much easier to just use a real person's identity.

They would also need to steal the persons SSN and likely need to get through one of those identity check questionnaires from credit agencies. And they’d probably need to fake an ID as well.

Non trivial stuff for a specific target.

Even for simple freelance gigs?