I think the idea is that missing files will immediately cause issues (tests will fail, etc), so CI should catch this immediately.

Adding extra, sensitive, files would not cause test failures, and even if they do (via secret scanners, etc), it is too late at that point because they will have already been shared upstream.

I am not sure the juice is worth the squeeze here, but it has some logic to it.