The other option is that the scraper got lucky with a tiny glitch (whatsoever).
On the one hand I bet github does everything to keep stuff secure, on the other hand I can't believe there wasn't a single glitch in the last few years.
And if there was a glitch then regular automated scrapers are a pretty likely siphon.
Heck I should check if any of my private repository show up.....
That's not "a tiny glitch". What you described is "GitHub may show your private repo to strangers randomly" which is a even more serious issue than they appearing in an archive some time later.
A lot of companies pay GitHub a LOT of money to securely host their code. A breach like this is a way bigger story than just another "AI is training on your data!" thing.
I continue to doubt that private repos being exposed like this actually happened here.