Regardless of that, my entire org relies on github globally. If we could not onboard or retain someone due to this I would raise this with our risk and compliance board and the product would be written off from the accepted vendors list almost immediately and cause a fuck load of evaluation and migration work and a $100k/year enterprise customer to disappear for them. That's how bad this is.

We already did this to two other vendors and we don't get a choice. It's a business risk.

That's the standard line. And it has problems when applied to companies with tens of millions of users.