It's all dockerized and security hardened probably. I'm guessing this is not that much of an issue. At least not any more than the likes of AWS, Google cloud, etc. allowing third parties to run whatever on their infrastructure. Not to say that there aren't any challenges but they aren't new challenges. And of course Gitlab has long been running CI infrastructure which would have the exact same issues.