[qqii]

From the threat it looks like Linus' threat model for git is simply different from the common use today. Of course a judgement under a different threat model would make it seem like a bad tradeoff!

[staticassertion]

It's more that Linus:

1. Didn't understand the attack

2. Doesn't understand security

3. Doesn't care

He's shown this repeatedly for decades.