If that was true, i doubt git would have switched to using the slower version of sha-1 that detects attacks.