It depends on whether you are doing something security critical with the result.
Maybe you have a trusted table hash but only a user-supplied version of the table. Before you use that data for security sensitive queries, you should verify it hasn't been modified.
Basically, if you ever have to contend with a malicious adversary, things are more interesting as usual. If not, addition is perfectly fine.
That indeed is a major flaw. You have to use another commutative operation that doesn’t destroy entropy. Addition seems a good choice to me.
> And even without multiple copies of rows, you can force any hash you'd like
I don’t see how that matters for this problem.