Comment by haakon

4 hours ago

The disappointing truth is that we simply don't know. Satoshi never explained it. For SHA-2 it can be used as a mitigation against length-extension attacks¹, and this seems like the most likely explanation, but it's just speculation.