Unless, it is searching through repositories which someone paid to keep private.

What if that private key you accidentally committed, pushed, removed and pushed last week to your private repo is now showing up in everybody's Copilot?