For security reasons, we have no choice. It's specifically designed not to allow execution of arbitrary Ruby code. GitHub wouldn't run Pages if Jekyll didn't have this guarantee.
I don't use jekyll and have a fairly limited knowledge of pages but doesn't jekyll output static html? Even if you used a dynamic language to create the project, wouldn't it not matter because the end result will be static?
You'd be able to run arbitrary Ruby code during the compilation of your site. GitHub uses Liquid templates as a pseudo-sandbox: it's deliberately a weak system to prevent abuse. But it's lazy, because there are many other solutions that don't take away from user experience.
They could probably use Docker and not allow network access and limit the resources (including time) to do a build. I don't know if their business model would support it but it's technically possible.
