Deployment output is not repository history
A deployed .git directory may expose commit history, old paths, configuration and material removed from the current files. That history can contain information with a very different risk profile from the visible website.
The deployment artifact should contain the application output it needs to run—not the working repository that produced it. Blocking dotfiles at the web server adds useful defense, but excluding repository metadata from the artifact is the cleaner boundary.
Validate before declaring severity
An automated finding does not prove sensitive history is retrievable or exploitable. Validation must be authorized, scoped and designed to avoid increasing impact. The result may be serious, harmless, already remediated or somewhere in between.
Evidence comes before severity: confirm the actual response, the accessible material and the practical consequence before choosing the language of the finding.