Besides the copyright issue limiting the lifespan on GitHub specifically, I expect this attack to be undertaken mostly by highly resourced organizations in pursuit of competitive intelligence, not hobbyists in pursuit of dumping flashes to the Internet. This approach is not particularly novel - see for example the exact description of this attack in this 2015 StackOverflow comment: https://electronics.stackexchange.com/a/198395

Eh, it still requires to de-encapsulate the controller, make a mask and expose the controller to UV light, it's not a super easy process.

I know someone who's able to reliably perform the deprotection attack in their home lab. It takes some practice, but it's well within reach for an attacker with even modest resources.

And said github repos immediately DMCAed and if the companies vengeful enough, subpoenas issued to hunt down the uploader.

It's fairly easy to just ignore dcma requests on private systems though. You throw the letter in the garbage.

You are aware that in this case you become legally vulnerable to lawsuits from the issuing party, yes?

(Or if not in the US, there is plenty similar laws around, the EU makes you legally touchable the moment you are aware that it's a copyright violation and don't react ASAP for example)

Yes I am aware, but I am also not concerned. Honestly I can't count how many notices I've received over the last 22 years. Sometimes legitimate and sometimes not. They all go straight into the garbage. I received one when I was out of town and there was no possibility someone else was using my internet connection.

It's not good advice to give others either way even if you got lucky. Or rather, it's not good advice specifically because you got lucky. Consumer ISPs are very quick to shut down your entire connection if you get too bothersome with DMCA requests incoming.