Honestly, I would rather go for that specific info instead. CVEs for security, network graph and PRs for activity, CI maturity for security and maintenance, etc. Stars give you mostly popularity which is not necessarily correlated. But yeah, I agree they can be a single-number-proxy for the above.