Are the consequences significantly different than having private repos on Github to begin with?

I realize this is one more Github service with access to metadata about your code, so the attack surface is technically larger, but is the probability of leak that much greater from this service than it already is by having your code on their servers (which, I assume, are protected by the same security team)?

Maybe it's an oversimplification but my expectation is that any project with such sensitivity wouldn't be hosted on an external service at all.