Of course it does, otherwise a malicious mirror can (theoretically) work to find a collision between their malware and the legitimate file and serve you the former.

There's no good reason not to use a secure hash function.

If your threat model involves an attacker who is able to achieve a hash collision while still implanting a sophisticated malware, you should probably avoid downloading software from random websites...

It would be pretty impressive, as they'd need their malware to both do what they want and exactly match that hash. Not impossible, just clever.

well it does require one that can't have collisions. otherwise what's the point in "verifying"?

There is no hash function that can't have collisions by definition.

*isn't known to have collisions, then