True, which is why I said there is no need to migrate existing applications at this point. However, the existence of collision attacks makes it more likely that preimage attacks (which would allow to generate an input that will produce a given existing hash) will be found. More secure algorithms exist and are not prohibitively computationally expensive, no reason not to use them.