Why do they try to give me a bunch of (ostensibly unsigned) SHA sums over an insecure, unencrypted medium? Surely anyone who could modify the content could also

Why do they try to give me a bunch of (ostensibly unsigned) SHA sums over an insecure, unencrypted medium? Surely anyone who could modify the content could also just as easily modify the checksum.