I completely agree with everything you say here. I felt the critique in the article was way more strawman falacy than everything else. I use(d) git much more locally, and would never run into this problem because I would only use sha-256 on new repos. Rewriting the entire history is also not so much of a pain depending on organisation size and how it is done (if an org decided to do it). It may be a pain for git-hosts, but even there i think reasonable solutions can be found. Still not sure if I care about the switch though sha-1 worked and the security implications seem minor to my use-cases. I am much more concerned with code leaking online...

sidenote: i hate the term "forge", is it too late to settle for something less... cringe??