Why COMODO and other antivirus companies still uses SHA1

Isn’t sha1 and md5 cryptographically broken which let’s to bypass cloud in theory?
I would suggest to use of sha256.