I'd say checking out a malicious branch is in the same category as downloading a malicious attachment. By which I mean, it's kinda on you.

Downloading this attachement doesn't executes it. Checking out a branch in this case executes the file in the branch. Thats a big difference.