If I'm understanding correctly the final goal of blossom servers is to be censorship-resistant because they give the same hash so if it goes down the client can look for the same hash on other server and the server can be used over tor.
Client can and probably will use the "url" field returned from the /upload endpoint when composing kind 1 notes. although the GET /<sha256> serves a different purpose
Take this note for example View quoted note →
If my main server cdn.hzrd149.com went down or the image was removed from it. clients could lookup my preferred list of blossom servers (kind 10063 event) and start going down the list asking each one for the exact same blob (without needing to know how the server works)
1. 
2. 
Thats the point of requiring the "GET /<sha256>" endpoint to be in the exact same location on every server. so its super easy for clients to quickly fallback and check other servers
View quoted note →
2.
Thats the point of requiring the "GET /<sha256>" endpoint to be in the exact same location on every server. so its super easy for clients to quickly fallback and check other servers