> see e.g. Stuxnet taking out Iran's nuclear program using a previously unknown method of generating SHA-1 collisions, that looked kind of like how the academic community knew to generate collisions but with a different fingerprint)

To my knowledge, it was Flame that did this not Stuxnet, and it was an attack on MD-5, not SHA-1 [1]

[1] https://en.wikipedia.org/wiki/Flame_(malware)