During my consulting, every fork I've made that was integrated into a project, was upstreamed via a PR. Either that or just, you know, leave the fork available on a company Github account. And if an org requires sensitive, and proprietary modifications, maybe that org ought to be investing the time and resources to make it from scratch?