Shouldn’t commercial encryption systems be easily crackable by Governments?

Sure, although the real trick would be to find something that not only collides, but happens to represent the message you wish to substitute in place of the original - so if I digitally sign a statement that says ‘Oceania is at war with Eurasia’, you might find hash collisions that are readable sentences, but it’s overwhelmingly unlikely that you will happen to find a hash collision that means you can substitute my message with ‘Oceania has always been at war with Eastasia’ or something closely similar.

The team that did the work described at shattered.io decided what they wanted the two PDFs to look like before they started. It definitely helps that the PDF format can have a lot of non-visible redundancy for the attacker to modify.

The important point is “find a document that has a specific hash (that reads in a certain way)” is a much harder problem than “find two documents that have the same hash (and both read a certain way but with an important difference)”. So the attack is only practical if the attacker is the author of both documents.

So, a “I made this statement, and now I am signing it to prove I made the statement” situation carries much less risk of the signature being reused than, a “I read over a contract authored by someone else and signed it to prove I agree to it” situation. Especially if you happen to notice an abnormally large AWS bill on the desk of the contract author.

(Of course even the latter case is thwarted if you make a habit of insisting on a meaningless change to every contract you are handed. Or if you just keep a copy of the contract you signed to prove reasonable doubt if someone comes up with a different contract with the same hash.)