For example, xpdfreader, source of xpdf, is distributed just as source tarballs. The maintainer just publishes them every time there is a new version.
https://www.xpdfreader.com/download.html
https://www.xpdfreader.com/old-versions.html
https://packages.debian.org/search?keywords=xpdf
There is nothing in Debian or FOSS in general that mandates having source control.
(I remember that was a point of contention with WebKit/KHTML... in the olden days of 2000-something, Apple forked KHTML to make WebKit, and in order to comply with GPL, they just published source tarballs, which were basically impossible to merge back into KHTML.)
edit:
ahh I see that the xpdf that is in debian is actually different than this one; someone forked it some time ago and it is in in git here (but no github/other forge, just .git)
https://offog.org/git/xpopple.git/
well ok, maybe I was wrong. but still, a .git folder on someone webpage is not that much more reliable than a tarball on someone's webpage