I think many people don't realize that the git integrated shell prompts for example are not safe to use in untrusted git repos.

Lots of editors will also query git repo information for displaying information to the user, and may do this completely automatically.

If you "git clone" the repo, git will not clone hooks from my understanding, so the primary issue is unpacking a tarball with a git repo inside of it and then trying to do something with the repo.