all of Fabrice Bellard's projects are primarily available as tarballs from their website.

definitely more hidden than a public git repo. and allows for xz style backdoors without being able to investigate them after the fact.

I don't see what point you're trying to make. For me a tarball is at least as public as a "public git repo" (whatever that means). In fact I would argue a git repository allows for way more opportunities for obfuscation, seeing that it is a much more complex format.