Since the pre-commit bot pushes a branch, all checks are run twice. Can someone explain briefly why (security, maintenance etc.) we need these auto-update-PRs?

We should be able to disable the checks if the PR is opened by the pre-commit-ci bot: https://docs.github.com/en/actions/using-jobs/using-conditions-to-control-job-execution and the example here would suggest that if: ${{ github.actor != 'pre-commit-ci[bot]' }} should work

I've addressed this in #504.