> Surely the git SHA is "a form of versioning", isn't it?

If you're consuming a module from a git as a submodule, yes.