Yes, but these usually also come with checksums. Checksums on the same site as the downloadable file are not that useful. If an attacker can replace the binary

Yes, but these usually also come with checksums. Checksums on the same site as the downloadable file are not that useful. If an attacker can replace the binary, they can also replace the checksum. If the checksum is on another site, it makes it more difficult as an attacker would have to break in to both sites.