Hmm I was wrong, the current version of the built-in Git daemon has an --access-hook option so no problem there.

https://github.com/git/git/blob/56f37fda511e1615dc6df86c68f3...

The question is then: how badly do people want this and how many admins out there are willing to poke an extra hole in their firewall just for this protocol.