If they're distributing .dmgs or .exes and their server gets rooted the result is exactly the same. And if the download and webpage are hosted on the same mach

If they're distributing .dmgs or .exes and their server gets rooted the result is exactly the same. And if the download and webpage are hosted on the same machine (like, practically always) the checksum won't help you either. If you want to run third-party stuff and not willing to look at every little assembly instruction at one point you're going to have to trust somebody. Of course this can just be Apple (app store) or the Debian/insert-distro-here guys (only run code that's from apt packages from the official repositories). I'll just take the occasional risk.