This is true, but it's a question of what the risk is. Externally hosting usually has 2 possible catastrophic outcomes: data loss and data exposure.
As you probably have the code checked out by a number of employees, data loss is annoying but not catastrophic as you're probably not losing anything more than a few hours time.
Data exposure would have a greater impact, but the likelihood is probably around the same as if you run your own repo through credential compromise. The Github security team is probably around the same level of effectiveness as you are.
So it's probably not that big a deal. Having said that, we self-host our git repos :).
