I'm surprised the fingerprinting is so reliably repeatable that you can use an exact hash, like SHA-1. I would have guessed that noise or especially filtering could shift the peaks a few hertzes around. Why isn't this a problem?
Dejavu uses a locally sensitive hash (LSH) just like any other approximate search hash might. The key to note is that we're binning both the frequency and time units of the spectrogram, giving us room for noise/error. In fact, you can tune the granularity to which this happens by adjusting the Dejavu FFT window (DEFAULT_WINDOW_SIZE). This will create a spectrogram with few (and therefore larger) cells.
The trade-off with smaller cells is that with too much granularity (or if the audio is even a tiny bit stretched or we have small Doplar shift effects), we may miss the fingerprints we want (false negative). On the other hand, with too low granularity, we risk having our frequency bins too large and having perhaps another song/query audio match when it shouldn't (false positive).
Luckily in either case, we don't need to see all the fingerprints, just enough to align properly in time.
So to answer your question, Dejavu is fairly resistant to noise (and can be tuned with FFT settings) as long as the audio's original timing is unchanged.
Most people don't realize this, but usually artists/labels will have a different mastered version of a song on each platform. Spotify, for instance, has it's own normalization algorithm that it puts tracks through to even out the listening experience in terms of loudness (RMS). Of course artists and their mastering engineers want to have some control over how that sounds, so they will change it.