Lacking details, but people don't generally rsync a checkout of a git repo (including a .git folder) to their webspace, so you're right if the hoster did that, I find it more likely the people did that.

On the other hand just blacklisting .git/* is not great, maybe I want to publish something on that path, just like any other filename. It's prone to lead to false positives.