Yes, if they announce the new "integrated" dependabot version will continue to only use public APIs, that would be a major positive statement about the "openness" of Microsoft GitHub. Otherwise buying major tools and integrate them looks scary.