I couldn’t find any particular justification going through their website and other communication, it’s not perfect but it’s probably not that big a deal for an open source project to host their code there? If I remember I’ll try to send them a message asking about it

You are allowed proportional force in defending yourself, so if Timmy tries to hit you you are indeed allowed to hit him back insofar as it pertains to stopping harm being done to you or others.