Disclosing private repos against the owner's intent is a much more immediate and significant business risk than violating the license of open source code.

Maybe that shouldn't be the case, but it is.