Bots also regularly check for .git in common folders:

404 - GET /admin/.git/config 404 - GET /shop/.git/config 404 - GET /beta/.git/config etc..

or adhoc backups using the current date -- stuff that you think nobody would even try.

404 - GET /2020-02-27.zip 404 - GET /backup20200227.zip 404 - GET /backup.zip etc...

No webserver should be serving .folders in it's default config.