Here I come with another question!
Why SHA256 and not another algo?
Pretty much repeating something I've picked up in this thread and am still taking in, so correct me if I'm wrong.
There are other algorithms involved as back up in case one is broken.
EC and RIPEMD-160.
The process to get to a bitcoin address goes:
Private Key --> EC --> Public Key
Public Key --> SHA256 -> RIPEMD-160 --> PartAddress
PartAddress --> SHA256 -> SHA256 --> CheckSum
Full address is then made from:
00000000, followed by partAddress, followed by CheckSum
All one number.
So if RIPEMD-160 were broken in future, SHA256 would need to be broken too for attacker to profit. And Visa-versa
If EC were broken then (correct me) public keys that coins had been sent from might be vulnerable, but receiving wallets that don't send would still be safe.
EC - Elliptical Curve
RIPEMD-160 - RACE Integrity Primitive Evaluation Message Digest(160 bit)
EDIT: Rereading your question, I guess it's that SHA-256 is currently best choice when measuring security provided against work done.