It was their legacy but still in use auth system. Accounts created past some cutoff (before the exploit) were in another, more secure system that did not use s

It was their legacy but still in use auth system. Accounts created past some cutoff (before the exploit) were in another, more secure system that did not use sha1. They didn't move fast enough to get accounts moved over.