Not quite that dire: The checksum is typically public, where a large set of diverse stakeholders (most of which have incentives aligned with yours) can publical

Not quite that dire: The checksum is typically public, where a large set of diverse stakeholders (most of which have incentives aligned with yours) can publically dispute it's veracity, increasing the costs of fraud. Moreover, some of those stakeholders may already be part of your existing circle of trust (either directly or transitively), which increases uncertainty for fradulent sellers.