Out of convenience I guess. SHA256 was the most time tested, compatible in a big array of hardware, important for mining. Bitcoin was all about security but also about certainty. He couldn't risk it with more exotic algos so he went for 2 rounds of SHA256. Other alternatives may not come from NIST but they can come from Russian or Chinese intelligence if you are paranoid about backdoors at this level.