Well for one thing, the unscrupulous employee would need to have force push permissions to the origin repo. Even if they they did, once they change the history

Well for one thing, the unscrupulous employee would need to have force push permissions to the origin repo. Even if they they did, once they change the history change, other developers working with the repo would be alerted of the remote branch changing out from under them next time they try to pull. And even if the change doesn't result in a conflict, and each of those other devs blindly accept the resulting merge, the original authors' commits will still be in the history resulting from the merge. So if those developers ever pushed anything, the original commits would be re-introduced. Now, it could be abused if a single developer inherits a project that nobody else has checked out. But it's still a high risk strategy for the unscrupulous dev.