So here's the thing: OpenAI and other LLM's scrape the web for data, not just text.

If a page is accessible from Google, its HTML is accessible, including links to API's, script files, the keys in the URLs that were returned, etc. There's nothing here that requires Copilot going into private repos. All it has to do is look at the HTML of a page and its URLs.