I mean if they’re really looking for security, you don’t have to trust GitHub to host it, you can use GitHub Enterprise Server to self host your own GitHub.
Hella expensive like you say, but, if you’re set on GitHub and the enterprise support they provide, there are options.