Yes, it was necessary to download all the code to prove for example that it wasn't just unrelated data in that repo. Furthermore a big part of this issue is tha

Yes, it was necessary to download all the code to prove for example that it wasn't just unrelated data in that repo. Furthermore a big part of this issue is that database keys were stored in the repo. Source code of the site alone wouldn't have been so critical.