I think you're describing most KDF attacks, of which password hashes are particular (and easy) example. I can't think of an instance of this attack that isn't password hashes that is so widely deployed that it would be economical to invest in 9-figure supercomputers to attack it, but that obviously doesn't mean one doesn't exist.

Think about any software updates you do (Windows Update, apt, yum, etc). All these systems rely on distributing a cryptographic ally signed manifest of what each files hash should be.

If you can forge the hash of a file, or the signature on that manifest, there are hundreds of different ways you can easily replace one file for another in transit over the internet.

We're also not a supercomputer advance away from breaking SHA2. There are hash-designing cryptographers who believe we may never break SHA2 with conventional computers.

That's a very different attack than I was looking for; you've described a second preimage attack, which would be considered a fundamental weakness of the hash. I was looking for a protocol where a comparatively small amount of signed data (let's say less than 90 bits) is kept secret, but can potentially be brute-forced on an appropriate supercomputer.

I'd guess something like Quantum Insert + targeting unprotected connections. Which I'd imagine there are still a lot of out there (circa pre-2000).

I'd be curious if there's any older network gear that provides a hash-based rather than connection-based security model. It seems like the thing that might have seemed like a good idea to a military 40 years ago.