I think you're confusing the key/seed with the output. The paper is about key sizes, not hash output sizes. Again, if you claim it's trivial to recover the seed

I think you're confusing the key/seed with the output. The paper is about key sizes, not hash output sizes. Again, if you claim it's trivial to recover the seed in "almost all use cases", you should be able to demonstrate that pretty easily, no? I don't have anything against recommendations to use all bits in the hash output, or good collision handling, just these unfounded security claims about key recovery.