If we are talking about risks, note that sha1sum is potentially *less* riskier than md5sum. Fedora is anything but conservative though
The algorithm itself is less risky. Changing the release process to use it is more risky. Fedora users get to test the process change.
