They are, but they also host any OSS project for free, which is the only reason I know about the brand "GitHub". I think you severely underestimate how valuable that mindshare can be. Also, they depend heavily on products which depend on OSS projects for their product.

It only makes sense that GitHub would want to reinvest in security for their own supply chain. The only problem is that most other companies don't do enough of the same.