Hashing strength has nothing to do with it. The real lesson is that they should have signed the hash they put on their website and actively encourage users to check it.