That on its own is a security risk, as it would introduce means to hide a commit in the commit itself.

At least with the . file you have to make 2 separate transactions.

No it wouldn't. You would still be able to see the commit in logs and file histories and if you ran blame without the skipping option.

No. I don’t want the author to make that decision for me. I’d rather git record everything and then I can choose how to view or render it.

Different people have different view preferences.

Ok but why not both checked in and user settings with the user overriding the repo?

I would guess quit a few malware authors would also love such a feature.