You can't attack an existing normal commit.

But also collisions there aren't a big deal. People will cite short hashes when referring to things and that's not "broken".