Yes, if you sign off on commits you haven't reviewed to confirm the diffs at all, and they're carefully crafted files to make the collision, you may commit a duplicate sha-1, which still doesn't even break Git.
This is an important distinction. Without a preimage attack on sha-1, the only vulnerability is if some part (yet any part) of the git objects reachable from the signed tag or commit is one half of a prepared collision pair.