If you use GitHub for sensitive internal stuff you will have a contract with them. This is different from users dumping your data into a service of a vendor you have no business relationship with.

And Windows and VS Code don't upload your data to Microsoft unless you choose to do so.