Why does it require access to code?

As far as I see, "Read access to administration, metadata, and single file" should be enough to configure this app using ".github/auto-comment.yml" file.

"Read access to code" permission disallow this app to be used in private organizations with closed source.

Start by reviewing the GitHub App permission configuration and the referenced .github/auto-comment.yml configuration. Determine whether the app can operate without read access to code, and verify that configuration-driven commenting still works for private organizations with closed-source repositories.

Written by the indexing model from the issue text.