I see.

Well exactly because Bitcoin Core is a free and open source project, anyone can contribute to it. I don't think you should hold the entire project accountable for the actions of any one individual.

Nor does it change the nature of the free and open source model; anyone can still fork the code.

Of course any project that operates on the open internet can be attacked in all kinds of ways, including Bitcoin Core itself. Being a FOSS project doesn't prevent that.

(To be clear I have no opinion on whatever it is Portland Hold may or may not have done because I know nothing about this.)