This is a comment more than answer
1-There is a slight divide mistake in the given answer ... the number ~3.6•10¹³ is on days, ie before dividing by 365.25. When we divide by 365.25 it becomes ~10¹¹ yrs
(I approximate 2¹⁰=1024~10³, so 2¹²⁸~256•10³⁶
~256•10¹⁷/(3•864) ~10¹⁶ days
»»»»»Apologies I am the wrong one here
2-These numbers has changed from 2017 till now
The previously 300*10¹⁵ is now 121.88•10⁶•10¹²= 121.88•10¹⁸
3-The resulting number being down by ~10³ ie ~3•10¹⁰ yrs still safe ofcourse, but I think the risk could come from analytical attacks too, Differential attacks I mean (I've always been impressed by their old S-boxes story with DES)
4-I just found this paper today (while editing the answer) but I have no access to it's full version
-What if someone like entering previously hashed data as a learning/training set into an AI system for example???
In fact the AI thought just crossed my mind in this very moment.
(If we humans cannot analyze some patterns, doesn't mean AI can't)
5-From a new brute force paper
HAL Id: hal-02306904
The actual computation was done on aging hardware. It required 7 calendar months using two obsolete second-hand bitcoin mining devices converted into “useful” computational devices. A second step required 570 CPU-years on an 8-year old IBM BlueGene/Q computer, a few weeks before it was scrapped.
To the best of our knowledge, this is the first practical 128-bit collision-like result obtained by brute-force, and it is the first bitcoin miner-accelerated computation
6-I think it maybe useful also to bring Justin Drake estimation to the discussion too, evaluating his words with the conflicts of interest in mind ofcourse
Sorry if this kind of brainstorming more than an answer