I think this is definitely a concern, yes.
I think it's very likely that these models are effectively being tricked into retrieving source code of projects from memory of seeing the actual source code in the biases. This is why some project are much easier to uncover than others.