You are right about secret scanning, but its worth noting that is only enabled by default on public repositories. It is an extra paid feature for organizations

You are right about secret scanning, but its worth noting that is only enabled by default on public repositories. It is an extra paid feature for organizations on a teams or enterprise subscription, and isn't available at all for individual owned repositories outside of an enterprise subscription. And yes, I agree there is indexing of commits, but that is a batch insert from a log.