On the other hand, I'm less confident about the conversion to bzr. And anyway the relevant question is not "would it have broken?" but "did people have reason to expect it would break?"
And on the third hand, a commit id could be referenced by author and timestamp, which would be invariant under (competent) repo conversions.
That said, referencing the commit by author and timestamp, instead of internal commit ID is the robust solution.
(Another company I worked for had commit log entries like "I like cheese" so perhaps this company wanted to erase history for a reason. Here in the 21st century version control systems finally get the respect they deserve, though I bet there's a sad number of shops that still don't use one).