I prefer CIC's comment-answer, but the way I have always viewed it is that collisions aren't always useful.
Maybe two text strings can have a collision and if they fit in a password input field, that's a problem.
But what are the odds of useful malicious code, that actually works, being injected into another program and generating the same checksum? Probably absurdly small.
You'd need a wonder-computer to take the legit software + malicious code, and figure out what kind of garbage data needs to be added to the file in order to create the same checksum and filesize and all of that.
So in that regard, not really a security concern.