You can still use the SHA if you want to. What it achieves is transitive pinning (which this post doesn't properly highlight).

Lack of transitive pinning support was the biggest supply-chain security criticism against GHA and I'm glad they are finally tackling it!