There are many ways to induce download of the wrong file, not just tampering with the origin website. An old-school MITM remains a real hazard and in some organ

There are many ways to induce download of the wrong file, not just tampering with the origin website. An old-school MITM remains a real hazard and in some organisations/nations it is directly enabled by the local infrastructure. Ultimately this is why we also sign the checksum. (Now you have to protect your signature verification supply chain. It never ends)