I think that bors can use Github’s protected branches and status checks to make it a lot harder to press the big green do-the-wrong-thing button.
If bors puts a failing status on each PR, that can be used to disable the merge button by making bors’s status a required status check for pushing to master. Then, once bors is ready to merge, it can change the status to succeeding and then immediately push to master; there is a small window for a human to click the button between those two steps, but you’d have to be unlucky to have that happen.