> The role of a vendor is supposed to be to enable mechanisms so that customers can implement whichever policy that best fits their needs.

this is where GitHub isn't a vendor; it's almost a social network as one account getting compromised could potentially cascade through projects. If you want to manage the risk profile that best fits you; you'd localize on GitHub Enterprise or other selfhosting.