Yeah I'm curious about this myself. Doesn't this create a pretty serious security situation? GitHub isn't a small startup anymore, I would assume they'd have some pretty serious security precautions in place.
They also handle plenty of trade secrets, I'd bet. They have private repos.
With so many self-hosted Github alternatives, and even Github Enterprise (self-hosted Github), I don't feel sorry for anyone having trade secrets stolen if they were hosting via private repos on Github.com.