If one person has access once and publishes it, the work of setting up a proper md5 was a waste compared to an xor.