[zeeZ]

Plus, if you're super paranoid, pulling doesn't require leaving any ports open and software listening on the repository.

[tamana]

But it requires leaving a port open on the DB server where an attacker can get a whole copy of your database, or destroy it.

[amdavidson]

Many database servers are not serving databases solely to themselves and have that port open as part of the normal course of operation.