Which is valid, but what's the timeframe for rechecking and validating if there's been a change? I'll posit it's practically impossible to catch every single change within a reasonable timeframe to ensure that "a repo no longer public, today, within a data set collected earlier" would be excluded.
I may be misunderstanding your suggestion. If so, I'm curious to learn what I missed.
My assumption is that the "my private repo was included" crowd are misremembering that their repo used to be public at some point in the distant past (~years). My suggestion would be that they re-scan before each major revision of the dataset (such as this upcoming "v2" release). This would be a relatively expensive process given the numbers involved, but so be it.
(edit: I think "v2" is already released, but you get my point)
I can get behind this idea. Thank you for clarifying.