I really don't see how GitHub can justify allowing public access to dangling commits.

Surely they have a whole army of paying customers demanding proper data deletion ability (required for all kinds of legal reasons - eg. We accidentally committed code we don't have a licence for, or PII of Europeans, etc).

A simple rule saying 'any commit which ever has a refcount of zero will become forever inaccessible unless reuploaded' would do the trick.