The idea is that multiple independent builders build the same distro. You expect all of them to have the same final hash. This doesn't help against the sources

The idea is that multiple independent builders build the same distro. You expect all of them to have the same final hash. This doesn't help against the sources being owned, but it helps about build machines being owned. Accountability for source integrity is in theory provided by the source control system. Accountability for the build machine integrity can be provided by reproducible builds. To answer your specific questions: The attacker has access to the distro's build servers and is packaging and shipping altered binaries that do not correspond to the sources but instead contain added malware. Reproducible builds allow third parties to also build binaries from the same sources and once multiple third parties achieve consensus about the build output, it becomes apparent that the distro's build infrastructure could be compromised.