Some other examples:
https://github.com/cran/archetypes/commit/c4b904b4b83392724ab1bb68dad2046150aba448#diff-35ba4a2677442e210c23a00a5601aba3
https://github.com/cran/bartMachine/commit/aa807bf660925220891c5c2edeba08bde4a23481#diff-35ba4a2677442e210c23a00a5601aba3
https://github.com/cran/bfp/comm
I've noticed a trend in the last year of a CRAN maintainer making
modifications to packages without notification to the package authors or
the community. Some times these have been made during a submission [1]
and, in other cases, for existing packages [2]. In the latter case, we
intuit that ther