A similar reason for why the secp256k1 elliptic curve was chosen over the secp256r1 curve for DSA signatures.

Although, that does not mean that any of those are immune to future discoveries of vulnerabilities or backdoors or being broken.

And if/when that day comes, then the community will have to accept a hard fork. Fingerprinting all the accepted block history, and using new hashing or signing algorithms for future blocks.

Could Satoshi have added a small cryptographic spec to each transaction to detail the hashing and signing algo, allowing them to be changed w/out a fork? Or would that come with its own risks of the blockchain's security being subverted if it is made too easy to update such things.