Or, knowing that it's the only way they have to recover from this situation, they could make the process easier to do and price it out as a service.
Or, just leave everything in place, always, and have the other code ignore the annotations for exactly as long as the repo is private.
Just FYI - you can star private repositories so it's not quite that simple. You'd need to determine if the starring aligns with permissions... but I think it's still relatively reasonable.
Opening up the ability to do that externally would potentially require multiple people working full-time to handle the requests.
"We even offered GitHub financial compensation for any resources required." Considering the tone of the article I think there's a very high risk if github accepted agreed to that we'd see an article titled "Github charges popular open source project $5000 to fix a minor accident"