Because broken means collisions, not reversal. Anyone can now construct two different files sharing an MD5 or SHA-1 digest, which is fatal for a signature — but working back from a digest you were handed to a file that matches it is still out of reach. So for catching a truncated download or a flipped bit, where the adversary is randomness rather than a person, both remain perfectly adequate, and reading a checksum somebody published years ago is a good reason to compute one.
Choose SHA-256 when you are picking rather than matching something published, and whenever a person could deliberately craft the file. Also what a matching checksum proves and what it does not, why one printed on the same page as the download is only worth much against accidental corruption, the usual reasons a digest does not match — a trailing newline is the commonest — and what HMAC adds over a plain hash.