> believe that risk is reduced because we're application software instead of infrastructure software.

Why do you believe this? My project uses self-hosted gitlab (ancient version) and I frankly have a very hard time seeing it as anything other than infrastructure. Maybe we just don't push our use of gitlab a lot (to be fair, we don't push it at all).