In an old 2010 Q&A at StackOverflow, Pornin states:
… a good hash function "should not" allow a property such as surjectivity to be actually proven.
This makes sense to me when looking at, for example, the SHA-2 function family.
Yet, in an answer to Has any crypto hash function been proven to be surjective?, Lindell provides an answer with a nice example of a hash function that allows such proof.
Since the widely known, theoretical construction based on the discrete log problem combined with a Merkle-Damgård transform seems pretty solid at first glimpse, it begs for the question why alike hash constructions don't tend to be practically used more often. The surjectivity (and according collision resistance) proof seems to be a plus when comparing it to the somewhat non-provability (more of an assumption) of the surjectivity of SHA et al.
Is this merely based on the fact that discrete log functionalities tend to be computationally expensive and harder to implement on specific hardware (compared to constructions like SHA-2)?
Or are there other implications (maybe related to cryptographic security or specific attack vectors) which could explain why such theoretical hash constructions based on the hardness of the discrete logarithm problem don't tend to be practically used and preferred (due to the more clear proof)?