I've had the pleasure of working with absolutely outstanding security professionals, doing exactly what you see - relatively thankless work.
Due to the alignment of incentives, it can in fact be worse than merely thankless and face internal opposition - so the perverse reality of Microsoft/GitHub needing to feel more pain is sadly likely true.
This article's author is wonderfully honest about having not worked at a larger company and is right to call out the issues that are all about organisational alignment/ownership.. or lack thereof.
You could never pay me enough money to be responsible for security at GitHub though, that's for sure.
Is this happening? GitHub status page is a Christmas tree for 3 quarters and comically had an incident 10 minutes after the "we're working hard on fixing stability!" blog post published.
The free market has responded by buying GitHub Enterprise to avoid the incidents. So we've effectively rewarded GitHub's lack of serious engineering with more money. Doesn't seem like they have any real pressure to improve.
This (IMO) points to a perverse reality: things need to get worse before they can get better. In other words, Microsoft probably needs to feel more pain (in the form of negative revenue pressure) before they take their own platform responsibilities (vis a vis not distributing malware) seriously.
We say this play out recently with improvements to GitHub Actions security, I expect we'll see the same here.
(Edit: to be absolutely clear, I have first-hand experience that GitHub's security folks work extremely hard, and are often doing the kinds of invisible, thankless "deck-swabbing" work that nobody even thinks about. They're just under-resourced.)