[Verizon Galaxy S 5 General] t3t5u0:
/facepalm

Not to insult anyone, because the XDA community is some of the sharpest people I've ever know, but this is the type of stuff that drives me batty professionally. I'm a working Fortune 50 InfoSec consultant, and I've done lots of security, including my share of rudimentary cryptanalysis work over the years, and it never fails to amaze me that people still chime in on various threads with 'let's just hack it', and demonstrate a complete lack of understanding and quite frankly, respect for the technology that goes into these secure solutions so let me break this down so we can get serious about this.

SHA1 is a hashing algorithm; mostly for one-way encryption, just like MD5, for data integrity, sometimes digital signing, etc. It is not the same as a digital signature like a PGP key or an x.509/PKI cert (SSL, SMIME, etc.) which are vastly more complex with a typical bit length of 1024. Yes, some Chinese researchers a few years ago did find a way to produce collisions more efficiently for SHA1 in order to brute force a hash. Simply put a collision with a hashing algorithm is when 2 random factors produce the same hash; 2+2=4 and 1+3=4.

To circumvent the GS5 bootloader which is signed, and has signature checking, requires producing a boot loader with a valid hash to bypass the signature integrity check. This isn't like guessing your kid brothers Facebook password, it is closer to guessing the random session key of an SSL session to decrypt the data within. Heartbleed aside, it is simply mathematically very nearly impossible with any computer systems we could amass with any budget we could gather, and we would all be dead and gone for thousands of years before we had anything close to success.

You are FAR more likely to win the Powerball jackpot back to back five times over.

The GS3 bootloader fix was likely due to a lucky leak. The GS4 MDK Loki was due to a very dumb opening in the kernel. No one is going to brute force these things open. That is a waste of time and resources to bother discussing. We need a valid exploit in-between the bootloader and the OS to insert code into the trusted path and disable or bypass the signature/integrity check (or get a valid signed unlocked bootloader like the GS3). Very difficult to do if the security is designed properly. Try hacking a modern laptop with a Trusted Platform Module (or Xbox for that matter) and an encrypted hard drive as a reference, these things are not trivial.

That being said, we will be lucky to achieve root on the Verizon/ATT GS5 without a major break (leak, serious security vuln, etc.). Android and Sammy phones have been getting progressively more secure over the last few generations and they are only going to get more so. The only saving grace is that as the Android OS evolves, more code is added, and newer vulnerabilities are introduced, but Google is getting better at security, most of the low-hanging fruit has been plucked and patched. The devs getting root on modern devices these days are likely much more skilled than those getting root on Android 5yrs. ago. It's a technology arms race, the device and software gets more hardened and skills required to crack them open is a higher bar than the previous generation. Just like you can't easily pirate Direct TV or modchip a Playstation these days, security engineering is getting vastly better and device freedom will get further out of reach as time goes on. We need to support truly open devices and carriers, not keep assuming that whatever they release we will just crack it on day one and teach them a lesson.

Now to quickly address the 'why'. It isn't a conspiracy to simply make us mad or to prevent you from customizing your device. There are legitimate business reasons for locking devices. If a devices security can be circumvented by a 'good guy' for the right reasons (like the XDA crowd) it can be just as easily be circumvented by the bad guys for all the wrong reasons, like installing malware to steal your info, identity, hack your Google wallet and finances, etc. Also, Samsung is trying to get into the lucrative enterprise market and security is a necessity for this. I consistently see threads on XDA that 'I need root to bypass the Exchange pin' policy. You don't have the right to access your companies information (yes, they own every email you receive or send legally) without a PIN or password for your convenience, just like I don't have the right to remove the locks from your front door cause I don't like knocking when I come to visit. Verizon and ATT may indeed not have our best interests in mind when they lock their devices, but let's not naively assume that there is simply no good legitimate reason for security on mobile devices.

/end rant :D