... do not migrate old repos? I'm not sure why people would do that. Or, if they do, why would they replace the current repo name instead of creating a different one and keeping the old one closed to make the references work.

I don't think this is going to be a problem at all.

Hmm. If this is a security issue that matters, would you not be expected to migrate?

Not talking about archived code, but active projects that pre-date git 3.0