They can do that in private repos just as easily, this a pr stunt that backfired very badly.