As someone who's written firmware in a corporate environment, I doubt they forgot. We had a security requirement that mandated certain fields be obfuscated. It was a pain in the ass and completely useless given the nature of the device the firmware lived on and the nature of the firmware itself. So we did the bare minimum to pass the stupid scanner someone decided was necessary 10 years ago.

This smells like a similar situation, it's not like they don't have enough horsepower for MD5.