I've never seen a Jenkins instance that did not need to be open to the public internet in order to support GitHub webhooks. Granted they were using IP based restrictions but it's still not behind a corporate network by any stretch in that setup.