First of all what you are doing is not encrypting (SHA256 is also not an encryption algorithm). It is called computing checksum.

Secondly, since this checksum is very small (2 bytes) it is not that hard to brute force it and create a fake address with the same checksum. I computed this address in a second with the same checksum.

Of course this is just a concept to show how easy it is to find a "collision" when the checksum is very small. In practice the attacker needs the key to the malicious address which means they have to perform a process similar to generating a "vanity address", an address that has the same starting characters. The extra 16 bit checksum doesn't slow down that process enough to be impactful.