There is additional hash checking indeed. Google Play will fail to install an APK you MitM to the app. Edit: the hash checking is done in addition to the APK s

There is additional hash checking indeed. Google Play will fail to install an APK you MitM to the app. Edit: the hash checking is done in addition to the APK signature verification, i.e. you can not replace the APK with a different APK signed with the same developer key.