That's completely ridiculous (and, unfortunately, also completely plausible with companies) - see the so-called "analog hole" (or in this case even digital - if it hits the browser as textual content).
There is still a big difference in terms of attach surface between a complete repo cloned in /home/$USER and some transient partial information that is gone (in theory) once you close the application/browser, so I don't see why it's completely ridiculous.