Do low-entropy fingerprints actually make any sense?
Short key fingerprints are indeed vulnerable. But those are different from the short-authentication-string (SAS) used by ZRTP.

A simple SAS based protocol using one-time keys could look like this:


Alice sends a (collision resistant) hash of her public key to Bob.
Bob sends his public key to Alice
Alice sends her public key to Bob


The short authentication string is computed as hash of both public keys.

Bob can't deliberately influence the SAS because he doesn't know Alice's public key yet. Alice can't deliberately influence the SAS in Step 3, because she already committed to her public key, by publishing its hash in Step 1 before she learned about Bob's key.

Alice could abort the connection after step 2 or Bob after step 3, but that should display an error to the user and can't be pulled off too often.