The messed up thing is a lot of small startups use github in private repos even for non-open source projects, for lack of knowing any other tool. The problem is being able to expunge sensitive data especially if there is data you don't want everyone in an org to have because of separation of concern. This is why I think self hosting gitea or even a non-visual software like git over ssh makes sense if you are doing something actually sensitive.

Then if you are doing an open source project you should consider the instance of your open source project to be proprietary. Code your open source project like it has nothing to do with your instance, then deploy it like you are your own open source customer. Of course you would want automation to deploy your instance configurations and custom code so you can apply updates to the open source project by rebuilding the instance instead of applying code changes directly to your instance.

That or join the dark side and embrace closed source. Open source is seen as this anti-corporate alternative. The reality is corporations are able to leverage open source more effectively than individuals. When you do open source you are just programming for corporations for free.