To bring down the point, here's the source code for that link shortener: https://github.com/technoweenie/guillotine. It was last updated in 2015. If you don't believe that this is the source code, this was directly linked to in its announcement: https://github.blog/2011-11-10-git-io-github-url-shortener/. If the extreme lag (in an attempt to save the links) is indicative if its backbone, it's probably just running in a single server, which is very likely to be horribly outdated. It might not be due to the cost of removing the malicious links, it might be that Git.io as a platform has a cost in of itself (even excluding common things like domain and hosting costs).
You just proved the point.
https://github.blog/2022-04-15-security-alert-stolen-oauth-u...
“The applications maintained by these integrators were used by GitHub users, including GitHub itself.”
* Technically the links are not publicly listed, which might jeopardise some obnsscure but technically-available repository, but it doesn't store private data.
From the original post: “due to the security of the links redirected with the current git.io infrastructure”
What does “security of the links” even mean? Disclosure? Tampering?