The problem here is not about modules breaking. Even if gitlab went away nothing would break because of vendoring and proxies. The problem is if gitlab goes away and someone buys it and starts pushing malware through it, there is no way to distinguish a malicious update from a legitimate one.