Whoever owns a given GitHub repository has the final say over what code changes are applied to it. This is the same reason I maintain my Satoshi fork of Bitcoin Core. It contains metric collection code changes that would never be accepted by the upstream project.

So doesn't that really make the argument that "Luke is the sole maintainer" more of a function of the fact that Knots is a fork of Core, than some sort of apathy? Given the contention between the two?

Forks can have multiple maintainers. Luke could implement the same security practices as Core if he wanted to.

Okay, how exactly? Unless he literally copies the code to his project. Then there would be duplication issues correct? This is obviously more of a Github issue than a code commit, merge, or push issue but still.