What's the plausible worst case scenario here? GitHub accidentally trains on private repos (or Microsoft is, insanely, lying) and leaks some random tiny snippets of your code? That would be a personal violation but the actual damage seems negligible.

I mean self-hosted GitLab is fine, I don't know that you're losing out on any major features. But I wouldn't worry about using GitHub unless security and control of your assets is a critical necessity, in which case you definitely shouldn't trust some VPS/cloud provider either.