The problem of course is them storing private credentials on Github despite numerous highlights on the site to not do so.

Private github sites are private as in hidden. Not as in digitally encrypted bank vault.

What sort of tech company doesn't go for a self hosted git option anyway!?

Like Gitlab which comes with CI to keep the whole thing private.

Also self hosting allows an arbitrary level of security..