This example given in the link also does not execute arbitrary code from just cloning the repo, nor does any other repos you directly clone. You would be required to run commands to setup the exploit.

There is an issue around embedded bare repos in archives, however, that is not the given exploit in the linked repo at all.