It's true there are no guarantees that sha-256 does not have a backdoor. There is always a possibility.