The output of cryptographic functions is, by its very nature, random-looking and effectively untestable. To have a flag that allows you to replace the hashing with a "pass through" function is valuable for the purpose of ensuring that your code is doing the right thing.

A fundamental principle of cryptography is that it's nearly impossible to tell if a hashing function is working properly - it's output is intended to "look random."

When I develop systems like this I always have a flag that gets used everywhere I mock a cryptographic function, and that flag also turns on a HUGE BANNER in the output. It might not be impossible, but it's very, very difficult for the non-secure version to get deployed.

The situation is more nuanced than that, but there definitely is a reason to have this kind of insecure code in existence. The trick is making sure it's effectively impossible for it to go live.