forbid-new-submodules is broken

The hook does not have an explicit types section.
Default types: [file] does not match submodules (which are directories). It works only if you commit some regular file together with committing new submodule.
Specifying types: [directory] helps but not much: it works as a pre-commit but doesn't as pre-push or any other way when you specify --from-ref and --to-ref.
I'd suggest stopping ignoring provided by pre-commit list of files and check git status for provided files instead of diff.