In my case, it's never part of the publicly-served tree. public/ is a subdir within the repo.
I have a public www folder too if I only want to open up part of the whole repo. But since there is usually no sensitive data in a public-facing repo anyway, I don't care if people can access .git or not. They may clone it if they want! :D
no safeguard whatsoever. i'm the only user so ... :)