the hashes do offer some sort of practical security. you can probably configure github to disallow force pushes which means it is now impossible to push something without the new commit being shown to the reviewer. (and peer to peer you can provably configure so you only accept fast forward on a branch)
This means it is harder for an attacker to sneak code into a PR.
It is a minor security piece but all layers of security add up!
This means it is harder for an attacker to sneak code into a PR.
It is a minor security piece but all layers of security add up!