I don't know much about this. How does that enable vulnerabilities exactly?

Trusting a forced push w/o any other verification means nefarious history changes can be slipped in.

You can still verify the contents - the content blobs don’t change after the migration. Not sure if there’s a practical attack one could do but maybe

	▲	awesome_dude 22 minutes ago \| parent [-]
		Um. how do you verify the contents? The history is for the contents you now have, not what might have been