I think that the SSoT (single source of truth) is VCS (e.g. Git) Am I right?
All the metadata files that represent your org (as best it can) is the "truth". You'd really want to use "all" in this case to call it the representation of your org. When you put that in one accessible location, it becomes the single source of truth.
Git is just a version control system (VCS). It's used to track changes in any set of files.
To reiterate, having one location with those set of files that represent your system is really the single source of truth.
You could then have those set of files be hosted remotely using many services catered for git (Github, Gitlab, Bitbucket, etc).
So, in essence, wherever you decide to store your set of files (in this case, metadata from the Metadata API in Salesforce) is the single source of truth while git assists your workflow in all developers accessing those files, making changes, and tracking changes.
Both org based and source based development are important. Source based works better for code merge and application development where limited metadata types are needed. This model works well for developers using Salesforce DX and Visual Studio Code. But system administrators dealing with the other 200 metadata types need org based sandboxes and release management systems. For example, there is not much point putting Profiles in Git. They are huge and not human readable. I've written about some of the best practices, here is a link: