In my experience with GitHub, dropped commits remain indefinitely accessible. I use this to my advantage on pull requests with lots of good commit context that I don’t want totally lost in a squash: by copying result of git log --oneline main… into the PR body. The SHAs remain accessible even after I force push my branch down to a single commit.
I think there is a theoretical limit to how long these commits remain accessible, but I haven’t ever hit it in my daily usage.