The service isn't supposed to be private, some repos are intentionally public. And including all external collaborators in some VPN scheme is not possible at that scale.