Sounds to me like a sound policy, if you go by the old standard of "eating your own dog food". As a software company, you should be using your own products internally. 1) You are gaining valuable usage and issue feedback that can inform product development. 2) Why would you want to invest money in your competitor, and give free PR to them by using their products? 3) You generate good PR for yourself, by being able to demonstrate what you do with the software and its potential benefits to others. 4) You are building internal experience and knowledge of products, which is one of the more sought after commodities in the technology sector today.

If they got your database, you probably have a lot more other critical security issues to deal with other than worrying about MD5 encryption issues...

Statistically irrelevant. The earth has been around for 4.6 billion years. They are trying to make a conclusion based on a data point that represents 0.02% of the earth's history. There is no other engineering or science field that would let you get away with making a conclusion based on that small of a sample size. That is like trying to say the Internet is never available because it was down 0.02% of the time during a one minute period of time and ignoring the 99.98% of the data that says it was available.