> it'd be trivial for a bad actor to change them if the files are compromised. But it's trivial for responsible members of an organization to set-up a continuo

> it'd be trivial for a bad actor to change them if the files are compromised. But it's trivial for responsible members of an organization to set-up a continuous, automated verification of the checksums listed on a web page. It wouldn't be practical to do that with the ISOs, directly. Of course if the organization is lazy or incompetent, and chooses not to do so, then they have only themselves to blame. But if you fail to compare your downloaded files to the listed checksums, that's all on you.