Well you’re right (especially wrt things like security scanning), but you sort of have to include Azure DevOps in the conversation nowadays. I think the end goal for Microsoft is to get the larger organizations into ADO, either cross-pollinate pipelines and actions or just replace actions with pipelines at some point, and leave GitHub for simpler project structures and public codebases.

That’s why you won’t see a ton of work go into e.g. issues/projects on GitHub. Those features all already exist and are very robust in ADO, so if you need those kinds of things (and the reporting an enterprise would want to be able to run on that data), then you belong on ADO.