Updating the Git protocol for SHA-256

This is the essential problem. There will always be shiny new hash functions that may or may not actually be secure. There will always be new threats against old functions. It is impossible to know, right now, what hash function you will need to be using in ten years' time. If you are not designing your system to regularly switch hash functions, you are not designing for security.

That's why they are making this extensible. They have the humility to realize that we don't know what we're going to need tomorrow.