Are you implying they're silly because "it's DVCS, they can just move elsewhere"?
I am implying that the hostname of the upstream DVCS repository does not matter to anyone who even remotely understands his shiny plaything.
In that case, please keep in mind that the repository hosting is the smallest part of what GitHub offers - it's all the stuff built on top and around that makes it worthwhile.
Like what? The issue tracker? Indeed, it is a rather dumb idea to sacrifice yourself to voluntary vendor lock-in - but that's not Microsoft's fault at all. As if Microsoft would endanger your precious bug reports...
Same goes for the JVM world and the main maven repository, the node.js hipsters and npm, et cetera.
Is there any language/ecosystem that has a nice package repository without a single point of failure?
Every centralized repository is a single point of failure. IMO, the sanest approach is C's: You'll just get your headers/libs from your OS vendor.