I'm sure it also depends on if the site was intended to be accessed "publicly" or not. Let's say, visually, all registration links were removed, but (as someone with internal knowledge of GitLab here did) could "breach" into the registration page.