I still assume that Copilot uses my private repositories as training data, with them taking some care to not make it obvious. The software house i'm working at actually took the whole thing seriously and is currently migrating to an internally hosted GitLab. Not sure what potential leak exactly scares the responsible team, but interestingly it looks like it makes GitHub lose some worried customers.