If you use the hash (that we assume you aquired overa secure channel) to verify the download of eg an installer for some sensitive software, and someone manages to give you a backdoored installer instead with the same hash, that would be rather bad.
Where the problem comes is when you can generate a matching 128 bit hash with your own content without having to do 2^128 different hashes (or strike ridiculously (lottery winner being struck by lightning) lucky and only need to do 2^100 hashes)
Then you send file2 which is actually malicious, and the service decides it has already analyzed this file and lets it go.
This would work on a lot of big AV appliances and software. A surprising amount of these are still using md5 for de-duplication.
The known collision weakness only allows generating two colliding pieces ahead of time with a hash value that you don't control. It does not give you ability to collide with a pre-existing file/pre-existing hash, so you can't attack any existing SHA-1-verified file. You can only attack files that you've specifically crafted/tricked to contain your colliding block.