It happens because the first parameter of
hook_node_access() could be either:
- A string containing the content type of the node
- A node object
It is a string for the content type when a node doesn't exist yet, for example because it is going to be created.
In fact, the first line of
node_node_access() (the implementation of that hook made from the Node module), is the following one.
$type = is_string($node) ? $node : $node->type;
Your code needs to check the type of the value passed as first argument, in a similar way.
The hook is invoked multiple times because Drupal is checking what content types should be shown in node/add for the currently logged-in user. In fact, your hook implementation is getting the machine names of the content type defined in that site.
Notice that, in Drupal 8, the first parameter of that hook is always an object implementing the
NodeInterface interface, so it is not anymore necessary to check the type of the first parameter.