When one executes code from a Makefile, one expects arbitrary code execution. When cloning a repository, or updating a clone of a repository, one does not expect arbitrary code execution. Moreover, one can inspect a Makefile before running code from it, by cloning the repository and looking at the Makefile with a text editor; but one cannot inspect what will be cloned before cloning it (and even if you could, for instance by looking at it through a web interface, there's an obvious TOCTOU risk).

I see the problem with hooks that run when a repository is cloned. I don't see it with hooks that run when code is committed.

I might consider fixing a readme typo in somebody's project while taking less precautions than I would running make.