It’s part of the danger of having a public “dotfiles” repository. It’s very easy to check in your .zshrc, only to discover that some script added an ENV var that contains a secret. Alternatively, the employee could have checked in a script that contained some secrets.
Thats why you use precommit hooks with secrets scan.