Because it's very unlikely to produce an identical checksum without trying to. So unless you're worried about malicious users, MD5 is fine.