Code scanning results should be visible to everyone, not only those with write permission on the repository

Anyone who wants to view the CodeQL scan results can just fork the repository, which makes hiding the results of code scanning the equivalent of this:

https://www.syslog.com/~jwilson/pics-i-like/kurios119.jpg

Requiring write access to view them just makes it less likely that projects will see fixes from people without write access, which is counterproductive for open source projects. Bad actors looking for security vulnerabilities will not be deterred by the write access requirement either, since they could always fork, much like legitimate contributors already do.

Maybe, if a security token were needed for a paid service, the security by obscurity from hiding the results might discourage casual bad actors, but since CodeQL is not a paid service for OSS projects, could we at the very least get an option to stop hiding the scan results on branches from everyone?