Why not try to warn the owners first? Taking the site off of those lists is a pain.

How do you do that if the website has no contact details and WHOIS contact form gets no reaction?

Contacting the registered abuse contact (per the WHOIS data) is just step one. If that fails then, sure, go ahead and let the domain registry know that the contact method on their file is dead and then it makes sense to put the sites on a blocklist

Feels like they find critical vulnerabilities in GitLab almost weekly.

That's because they do, as well as in every other giant product, because security auditing has gotten quite a bit better.

If you host it yourself, an outage on your side might end up taking it offline too.