The problem with hash avatars in general is that people want to use them for identity verification -- and humans are wired to do so automatically -- but technologically, they cannot provide this. The space of possible avatars (2^256, in this case) is far, far larger than the number of distinct objects that humans can distinguish between. Which means that there will invariably be "collisions:" two avatars that are not identical, but appear identical to humans. As a result, if an attacker can brute-force an avatar that looks very similar to, say, Elon Musk's avatar, they can trivially scam people.

It follows that, since avatars do not provide any proof of identity, there is actually no harm in greatly truncating the hash space when generating them! That is, rather than trying to encode all 256 bits into the avatar, you can use a much more manageable number, like 16. But isn't this too small? Won't there be lots of collisions? Yes -- but that's a feature! If collisions are common, then the average user will be aware that avatar != identity, which makes them less susceptible to scamming. But 16 bits is still enough to meet the real goal of avatars: quickly distinguishing between different people in a conversation (or transaction, or whatever).

(This also shows why making avatars more costly to generate, e.g. with scrypt, can do more harm than good: doing so makes collisions less likely, but still not impossible. Meaning that if a collision does occur, whether accidental or malicious, you are less likely to notice it.)