After that post on HN months ago[1] where users discovered OAuth permissions for unrelated things being used/abused to star projects without their knowledge this news of buying stars didn't come as a surprise.
It's unfortunate as I've seen stars used as a metric of trustworthiness in general user discussions.
[1] https://news.ycombinator.com/item?id=33917962