It is really bad. But I think other Git providers also have weaknesses. Maybe it is just not a public knowledge or exploited.