Open source projects use git to accept thousands of contributions from completely untrusted developers. Does no one in management ever stop to wonder how they accomplish that without constantly introducing malware? Or why the people with the most untrusted contributors actually prefer git?
If you can't trust your own developers with read access, you have a whole other set of problems. However, that's easy with git too. Just put limited access code on its own server. That's even easier to secure than permissions on a single server.
The next argument people make is, "Yeah, but with git you copy the entire history, not just the latest version." I have news for you. If you have read access to any VCS, you have enough access to create a git repository no one knows about. People do this all the time when management foists a subpar VCS on them. You don't know about it because it doesn't actually create the nightmare problems you fear it will.
There are plenty of reasons an enterprise might choose another VCS over git. Security isn't one of them. Probably the biggest reason is that git is more of one component of a VCS than an integrated system. You have to add your own authentication and authorization, integration with CI and bug tracking, etc. Also, git has a lot of power, but with that comes the need for locking down servers to prevent accidental use of that power, and more training. If you don't know about, or don't want, more advanced workflows, git looks like an unnecessarily complicated version of svn.