I wonder, if they are really only concerned about trust, will accepting external PRs but never giving commit access to external contributors work for them?

Of course, if they are also concerned about the quality of external PRs then that does not help.