They are probably not working on security fulltime, but just overworked devs who are wearing multiple hats.

What does GitHub's security team do by trade?

^/s^