I think the number of steps isn't really that important. For me I care more about permission being explicit and not implicit. I prefer systems where other users have to get my permission to interact with me rather than automatically having permission to do so. It matters more on systems other than github but I think there's still an avenue for abuse with the current set up.
It should be fairly trivial to script account creation, project creation, and marking someone as a collaborator. As such a troll could simply automate the process of creating accounts and junk projects and then add the victim as a collaborator to them. The result is a useless dashboard full of crap that the victim has to manually remove themselves from. The troll succeeds in screwing with the victim by wasting lots of time. If permission had to be explicitly granted there would be no change to the dashboard and all of the confirmation messages could be ignored, or ideally bulk deleted from the incoming message queue. I don't have any idea if there's flood prevention mechanisms built into github to prevent this, but with unlimited public projects on the free accounts it seems like an avenue of abuse for trolls.