However you could definitely argue that given that the projects in question are alternatives to GitHub, a developer interested in contributing will likely be invested enough to sign up for the alternative service.
Doesn't that support bmsleight's point? If Github is more popular than NotGithub, even among the developers of NotGithub, that doesn't exactly inspire confidence in NotGithub.
There are also other factors impacting a users's decision to choose one hosting platform/software over another unrelated to the functionality of the software, such as code licensing and self hosting capability.
In summary, popularity certainly can be an indicator of whether or not a software or service is worth using, but it's not a direct measure of the quality or robustness or whatever other factors you may care about when making a decision.
You'd expect them to never run the latest code in prod to avoid exactly this, but a cherry-picked vulnerability fix is one example of how this could realistically happen.
There's no point in running the service on your own, instead you need to go where the people/developers are and where you can be easily discovered.
But I wonder what's the excuse for Gitea as they're a pretty recent Gogs fork?
They're both pretty amazing though: Self-contained binaries and less than 5 minutes setup time, so totally suitable for ad-hoc deployment.
I've used a few GoGS servers, but none of them were public. Hosting a public competitor to Github is a different set of skills to developing a self-hosted VCS server.
https://github.com/go-gitea/gitea/issues/1029
* https://gitea.io/en-US/ The code for gitea is on Github. https://github.com/go-gitea/ * http://gitprep.yukikimoto.com/ The code for gitprep is on Github https://github.com/yuki-kimoto/gitprep * https://gogs.io/ Guess what ..... https://github.com/gogs/gogs