The visibility of Core devs to the world seems like a massive massive security hole, for them, and for btc in general; hosting the project on Github seems the same.

Obviously the project could be hosted someplace else, but think how much time required to coordinate it all, in a leaderless, decentralized group. Things that in an actual company would be no big deal become giant challenges; and in the intervening chaos, who knows what could happen?