I used github as an example. It's not about what's available, it's about what's appropriate/expected to be used at any given scale and what those thresholds are. I question that there is anyone who says "well, we have 30 engineers now, it's time to start bringing things in-house and on-prem". I assert that the reasons/logic to do so are divorced from the size of the org (except where size of the org influences the dollar amount shown on an invoice, which can push it in either direction).

But, even if the hosting of the code is locked down behind a VPN, the nature of it requires copying it somewhere else, perhaps to a laptop that gets lost/stolen. But that is an attack vector and risk that is not addressed by having the revision control only accessible via VPN (although it may provide access auditing capabilities to help mitigate/observe where copies of the code exist).