In the same way that Google don't dig through private emails to target adverts or 'learn' about customers based on their content?

I'm sure they'll be recording and analysing types of transactions; interactions between services for private repos.

But that's not what I meant - they'll now have access to much more data than just the public git repos that they could clone and analyse. All the associated merge requests; issues; teams; webhooks ... all kinds of data there