$100k isn't that much money, particularly since collisions can be reused for multiple attacks w/ length-extension. Heck Bitcoin has had (ineffective) spam attacks that have probably have cost around that much, and there's good reason to suspect they've been privately funded by angry trolls.

There's a lot of people for whom $100k is "fuck you" money.