> Why does your identifier need to be cryptographically secure?

There are many use cases where people are using the hash to guarantee no actor has inserted different code than they expect in a dependency, so the dependency is pinned to a hash. Not being secure, would be catastrophic for some use cases that people are currently using if widespread.

We could make a claim this is a misuse, but this is what people are doing.