I've always wondered this but felt too embarrassed to ask, screw it. Let's say the ubuntu 16 iso is infected with some kind of malware by a 3rd party. If they have control of the file, would they not have control of the checksum displayed on the site? I can understand if the checksum is spread to other sites for cross-reference but I'm having trouble seeing why a checksum from the same location as the file you're downloading is worth anything.
Any insight?