You can't rewrite history in git, that's what the shas are there for. An attacker who gains access to a repo can add new commits, but not tamper with the existing ones.
To clarify: You can, e.g., use interactive rebase to remove a commit from a branch. But that creates a new HEAD with a different SHA - this is why rebasing published branches is such a bad thing.
The parent was implying you could change history without anyone noticing. This implies modifying a previous commit whilst keeping the current HEAD the same, which can't be done.