So somebody makes it, they send the change over using a pull-request, and the other side has the choice of accepting it declining it?

yes

Why wouldn’t they just trust our devs? They’re clearly competent.

it's not really about that. it's a process thing to make sure changes are well-thought through, do what they're purported to do, and don't have any knock-on effects that would be unexpected. the model is used in basically all forms of software development -- most projects use them even for core devs. people only push changes directly into the repo when there's an emergency and something needs to be fixed immediately.