I'm willing to bet GH is being mirrored internally as you suggest otherwise you'd be exposing the only current digital copy to hackers. That just seems a reasonable expectation to me.
So the activity is likely happening on the larger and more exposed GH service, while internally there is a daily copy bring backed up that isn't (as) exposed to hackers.
Something life that would be a great way to displace risk.