Presumably, the goal of this part of the agreement is to harmonize various regulations, processes, and bits of legislation. It's included because that's what the pre-Agreement EU/UK verbiage says, not because someone thinks SHA-1 is adequate in 2020.

It makes sense in a way, because there wasn't really time to re-legislate every outdated multi-national standard and regulation that needed addressing in the agreement.

https://www.legislation.gov.uk/eudn/2008/616/annex/chapter/1...