I'm not saying GHA is much better, but Jenkins is literally swiss cheese, it has vulnerabilities every day of the week. Even just as an internal service not exposed to the internet it's dangerous.