I scanned all of GitHub's "oops commits" for leaked secrets

You are free to organize your version history as you fit, and you can certainly rewrite history.

The only issue you might have is signed commits from collaborators, that you can not resign.

But you can't coerce everyone in the world to remove all traces of the alternate history that was a thing before being rewritten.

So while you can make git forget something in your local repo, you can't make git forget across the decentralised set of repos, which is part of git's core design.

So in that sense, yes, git never forgets, by design.