(From my very limited understanding) making commits requires you to find a specific hash, thus making new commits exponentially harder over time.

At some point it would cost significant money (besides the developers time) to make commits. It's basically an economic game like bitcoin, that those people who have economic interest in the code, get to decide what's in it.

Silly games bruteforcing content until a "special" SHA1 output value is achieved.