I think they're being too lenient to be honest. Projects were assuming too much by recording and relying upon those hashes.