That's actually exactly my point. Dependabot did Github security alerts so much better than Github did, that Github gave up on trying to compete entirely.

Which is to say that it's incontrovertibly possible to beat Github at their own game and on their own platform. To the point where even Github agrees they've been beat.