There are easy collision attacks against MD5. If they used a stronger hash, we would know that they couldn't have been coerced to use a hash that collides with a bad version of the update.