Because the commit on their PR is not using a private email see: https://github.com/llvm/llvm-project/commit/0f3d53906eb6bc70a2d8a4f5a694785ff4c8653a.patch
The private email detection check only works if the commit on the PR was created on GitHub.com by a user with private emails enabled. Then, the commit on the PR would have a “hidden email.” If someone has private emails enabled, creates commits locally, and then pushes those to a PR, then those commits will have the email they used locally. So the check won’t be triggered in that case.
Squash merging on GitHubs UI counts as creating a commit on GitHub.com, and if “hidden emails” are enabled the final merged commit will use a hidden email.
This is probably the most common case, so the check does not work most of the time. The only instances in which people make commits on GitHub’s web UI as part of a PR are likely a) fixing typos, or b) applying review suggestions.