Why was an insecure merkle tree implementation chosen?
As with many things in Bitcoin, it is likely simply because it worked well enough, and such an attack was not immediately obvious.

Several of the choices made in the early days of Bitcoin don't have a full justification behind them, and were simply made because it worked at the time without any major, obvious shortcomings. This is one such scenario, as far as I'm aware.