However, now I see you said it should be Ubuntu and not Apache that should do this default configuration. I guess that'd make a little more sense as Ubuntu could be interpreted in this analogy as the vendor of the boot, pants and gun, and is generally geared toward beginner cowboys.
The real solution, though, would be for the customers to learn to use the gun properly. If they shoot themselves, then that's valuable experience they can learn from. If you put the metal plate, they might go on without realizing they're shooting themselves.
Of course "fixing" security problems at the level of the web server feels like adding a firewall to your server instead of avoiding daemons listening on public ports. It feels wrong. But it can be seen as another layer of security.
(You can of course buy shoes with metal plates in them to prevent injury, they're called "safety boots" and are mandatory in some workplaces)
EDIT: You can't substitute gun safety knowledge with legislation that requires all things (and I mean all) to protect against gun misuse.
Which is to say, anti-footgun measures are extremely common anywhere foot-shooting is.
The point here is that if you want to take this methodology for security, then you'll have to come with an enumeration of all ways the user hurt himself and implement a safety measure for each. That's neither effective nor efficient. Think of all pieces of clothing being required to be bullet-proof, cut-proof, stab-proof, acid-proof, hunger-proof, suffocation-proof, smash-proof, etc. You can't have everything protect the user from everything else via having a safety mechanism for each model-specific thing.
It's also different in that it doesn't limit the products functionality when it thinks that you want to make an exception to its primary purpose. A garage door opener is not going to refuse to open when you're trying to come in with a vehicle on fire.
A webserver serves files, and inside .git/ are files. You ask it to serve them, then its going to serve them. That you didn't realize you were coming into the garage with a vehicle on fire is no reason for the garage door opener to be required to implement a security mechanism for that very specific thing when there's loads more you could do without realizing.
Likewise, serving .git is a common problem. Not serving it by default would prevent it. Why is that bad?