Slack Says Hackers Stole Private Source Code Repositories

"The hackers apparently gained access to the company’s externally hosted GitHub repository using stolen employee tokens."

When I onboarded a couple years ago I thought my company's security team were paranoid to be hosting on-prem[1] GitLab in order to have full physical custody of our code. Now I wonder why more people don't do the same.

[1] Technically an EC2 instance in our VPC... we have almost nothing truly on-prem (including employees).