> a bruteforce over the MAC space wouldn't take long
Indeed, best supercomputers are running today around 10 petaFLOPS (= 10^16 FLoating-point Operations Per Second) and there are 2^48 ~= 10^15 possible MAC addresses.
A FLOP is quite a lot simpler than a SHA-1 hash, however.
The Bitcoin network might be a better comparison since it uses doubled SHA-256; currently it's at around 3e16 hashes per second, or 6e16 SHA-256 operations per second. That's enough to hash all possible MACs in less than a second.
Indeed, best supercomputers are running today around 10 petaFLOPS (= 10^16 FLoating-point Operations Per Second) and there are 2^48 ~= 10^15 possible MAC addresses.