While I do think the HP bloat for low CR enemies is a real issue and that the Gith encounter is pretty brutally balanced, it's worth noting that enemies in 5e aren't built like players and don't have class levels. They generally will have more hit dice than their CR and usually more than a PC of a specific level does (e.g. a Hobgoblin Captain in the Monster Manual has 6 hit dice despite being a CR 3 creature).
To be clear, enemy CR is NOT the same as enemy "levels" (if you're judging enemy levels by their # of Hit Dice and their abilities). This is because
a.) Enemies are meant to be simpler, easier to play by the DM, with higher HP and less overall power
b.) CR is calculated according to what an entire party of 4 level-X characters can defeat/take on.
However, enemies are calculated according to specific rules that correspond to player rules: e.g., they have X*(Hit Dice + Con) hp, and abilities corresponding to that level.
Eg., a Bandit Captain is CR 2 but has 10 Hit Dice** worth of HP, multiattack, and a proficiency bonus of +2, so he could be considered a *very* weak 10th level fighter except for the PB. However, it makes no sense to classify him as a "level 10 enemy" because a party of 4 level 2 characters would wipe the floor with him. Alternately, it doesn't make sense to label him a "level 2 enemy" because 4 Bandit Captains against 4 Level-2 PCs would result in a TPK.
If Larian *needs* to put levels on enemies (they shouldn't, or at least should use the term "CR"), then they'd need to choose a level such that a party of level X characters can take on ~4 of that enemy. For a Bandit Captain, this would be 4. Nicely (possibly by chance), level 4 corresponds to a PB of +2, which a Bandit Captain has!
**Also noted is that NPCs have hit dice according to their size. Medium creatures have d8s, Large creatures have d10s, etc.
