> What more damage can they do besides train AI on all code

That's GitHub code -> AI.

The damage will be AI code -> GitHub

CoPilot already gives (bad) code reviews on GitHub PRs.