Technically, a software project does not have to worry about collisions for hashes verifying their releases. That only becomes a problem where there is some sort of trusted third party that can be tricked into authenticating one of a pair of collided hashes.

There is a usability issue here. A 256 bit hash is so long as to be very hard to manually compare. A project might want to keep the length down to something reasonable.