I mostly agree. But would be more nuanced regarding Github Advanced Security.

Most features grouped under "Advanced Security" looks quite useful https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security Sadly Microsoft has to sneak copilot in there, but the rest of it looks good.

It's probably possible to get most of these features while avoiding copilot by staying away from Github. There are other code hosting platforms, and most support CI pipelines. Scans can be added to pipelines even if those platforms don't support scans out of the box.