SHA-256 is on the approved FIPS lists and are faster on 32-bit operating systems, which were surprisingly common in enterprise environments until recently.

People tend to be conservative in making changes for stuff like this, and don't do so until forced.