OK correct me if I am wrong, but Git is designed to not need a Hub, right?

We've maybe been lazy with how we centralise repos in this way.

But whatever GitHub is doing, Vervel/AWS/CF can also do when you deploy, and they maybe already do to detect bad actors?