Like in UploadPack I find this awkward wording.  Maybe:

  * <p>
  * Only refs allowed by this filter will be shown to the client.
  * Clients may still attempt to create or update a reference
  * hidden by the configured RefFilter.  These attempts should
  * be rejected by a matching {@link PreReceiveHook}.

Basically one of the corner conditions here is, lets say the RefFilter hides refs/heads/sekret from the client.  The client might still try to create that branch, as he can't see it, so he assumes its available.  We loosely enforce the security of that update within validateCommands(), but the PreReceiveHook really should be playing in partnership with the RefFilter to ensure the client doesn't overwrite a branch he can't see.