I have the same nightmare, so to mitigate risk I run a self hosted instance of Gitea [1] and set up nightly mirroring.

The folder with the mirrors is then uploaded to a backup provider, in my case Borgbase [2]

1. https://github.com/go-gitea/gitea 2. https://www.borgbase.com/