Same here, and I've found it's a good way to tell apart decent security researchers/consultants from those that just blindly run their tools and send the result

Same here, and I've found it's a good way to tell apart decent security researchers/consultants from those that just blindly run their tools and send the results. If I get a report that my app is vulnerable because it uses sha1, and it's obvious that collision resistance doesn't matter at all in the context where sha1 is used, then I know the reporter can be ignored.