For those of us who have only installed the Command Line Tools, you will find the Apple supplied git at /Library/Developer/CommandLineTools/usr/bin/git
so the command to disable this vulnerable version is:
sudo chmod -x /Library/Developer/CommandLineTools/usr/bin/gitThere is nothing hugely special about their tools - every other app apparently has to install into a different location as best practice, so I don't understand why Apple don't follow their own guidelines!
They don't. Plenty of comments explain where the Xcode git actually is.
They have three perfectly reasonable directories they can install into, which is what they recommend that application developers do when installing their software:
/Applications /Library /usr/local
So why do they feel the need to link git into /usr/bin? They could link it into /usr/local/bin - the $PATH variable includes this directory already.
You state that plenty of comments explain where the Xcode git actually is, but that misses the point entirely. Why is it linked into /usr/bin?