But, as it was pointed out in <https://news.ycombinator.com/item?id=31010522>, you can have nested malicious bare git repos.

I think long ago there may have been some bug that allowed it with a hacked repo, so it's not a ridiculous thing to consider, but no git won't let you and any way you could would be a major CVE.