If somebody clones the repo they can even rewrite history. But that is not the same as them being able to claim the ownership of a commit in the original repo.

Then in their clone, they made all the commits. But who cares about their clone?