Just like every other business ever.
Github do have your issues and un-merged pull requests "to ransom", though. Make sure to back those up if they are important.
Instead they play "data roach motel" and hold your data hostage. Very uncool.
You do not know other peoples' situations. And strictly speaking, demanding money to access your data is ransom.
> it would be better than automatically making private repo's public when you stop paying
False equivalency. I already said that "disabling repo and allowing primary user to download" was acceptable. I said nothing about private->public.
This whole situation only reaffirms my distrust in all cloud services.
EDIT: Seriously, -1 ? The user's data is sacrosanct. You disable most functionality, but you never, I repeat never delete data or make it irretrievable within a envelope of time for recovery. The only exception to that is if the user explicitly requests a permanent deletion - then you do so after appropriate warnings.
Maybe you can have them switch the repos to public if you go through their support, but Github doesn't offer that in their ransom note, and that would be an unacceptable solution, anyway.
Whether or not this is a risk to a given developer (or their company) is irrelevant to me, because they still have policy that allows them to hold code hostage for ransom, and that should make Github a complete non-starter when deciding on an SCM host.