I might argue that Slack has no interest in anyone's inner workings. I've been at companies building relatively uninteresting products that treated Github like it was the same as emailing source code and server logins to the competition. I could be wrong, but I have never heard of a single instance of a company on Github having code stolen because it was on Github. I have heard of many companies who have had their internal systems hacked.

I might trust Github more simply because their entire product and value proposition is built around the use case of storing code while some company that builds a restaurant app -- their primary business isn't building code storage infrastructure. So why add operational overhead because of unfounded paranoia?

Unless you're running your own metal in your own data center, there's always 'risk.' Even then, if your system is connected to the internet there's still risk.

Proper risk management isn't "paranoia all the time," but an evaluation of the degree of harm posed by a particular hazard along with the likelihood of that hazard occurring. Then mitigating that risk in a way that is commensurate with those variables.