They didn't have to, there are multiple ways a virus can end up in/on something. Also, the Git files weren't what were infected. The download itself was the issue. Once I had the files, the computer treated them as normal uninfected items, no false positives. The virus that hitched a ride in, on the other hand, infected a different file on my PC, and that file was ringing the alarms of my computer, but it only got infected because I chose to ignore WD's warnings about the download. I mean, in situations like this it normally is a false positive, I assumed it was this time as well. I was wrong.
Though, if it had been the Git files, I probably would've got rid of them regardless of false or not. Erroring on the side of caution, I don't let many potential false flag items stay on my PC either. Just in case they're not false flags.
And yep, Git_136_Windows.zip, that's the infected link alright. Took one for the team, clicked on it, didn't even finish downloading before WD blocked it, but the virus got in anyways and is now quarantined. I'll take the same steps as before to get rid of it.