From the threat it looks like Linus' threat model for git is simply different from the common use today. Of course a judgement under a different threat model would make it seem like a bad tradeoff!
1. Didn't understand the attack
2. Doesn't understand security
3. Doesn't care
He's shown this repeatedly for decades.