Here's what I found out: if I'm the only admin of an org account on dev-null, then the only way to relinquish control at the moment is if I do the assignment myself.
If I'm a malicious user, I can keep control of the devnull account for the org.
Removing me from the github organisation has zero consequences on the devnull account. I don't know whether that's even something that the app can listen to.
There should be a way to forcibly reclaim control of a devnull account: to remove a member and add someone else instead as admin, perhaps by doing a sync with GitHub on memberships.
cc @tom and whoever else is listening.
commit b936d51