“Git 3.0 will make SHA-256 the new default content hashing algorithm and it will be an incomprehensibly expensive and ultimately valueless and avoidable global nightmare.”
Chacon has the threat model right. Nobody breaks into repositories with SHA-1 collisions. They phish a maintainer or poison a registry. He also runs a company that sells Git tooling, so the migration bill lands on him too.