It's just the bare git protocol, there's no TLS or anything.

>I guess it's a fair point but surely users in this case will never be able to clone Homebrew securely?

I dunno, there's a chance they might be able to download the tarball over HTTPS.