Anyone at your company and just push to a public git repository at any time. Nothing stopping them except threat of consequences.
And anyone in the world can pull what was pushed to a public git repo before you delete it. You should always assume that has happened.
"Anyone can access deleted and private repository data on GitHub"