Open access to your scratch work while you're working is a ticket to getting scooped or to having people form misinformed and incomplete perspectives of what you're working on.
Private repos are the only way that my group is willing to use GitHub. Upcoming federal requirements may force us to divulge all of our code in the future. That's a very hard sell to the professors.
There's a big difference between publishing a paper, where, in some cases, every character has been vetted multiple times by every author, and opening your entire codebase and raw data to the world. Fully documenting and characterizing everything for external consumption adds a large burden to the task of publishing. It may be worthwhile, and perhaps even essential, but it requires a lot of effort that could be directed toward further research.
From a social perspective, opening up your data gives lots of angles of attack for others. (See the difference in interpretation of gamma rays from the galactic center from Fermi/LAT between the telescope collaboration and outsiders, for a topical example). Again, it may be healthy to open everything, but if you've spent 5-10 years trying to build an unassailable measurement, handing out every last bit of dirty laundry to your critics can be daunting. Science ultimately reaches the truth, but it's a lot easier to get tenure if your measurement isn't controversial.
Private repos are the only way that my group is willing to use GitHub. Upcoming federal requirements may force us to divulge all of our code in the future. That's a very hard sell to the professors.