If your threat model involves an attacker who is able to achieve a hash collision while still implanting a sophisticated malware, you should probably avoid downloading software from random websites...

It would be pretty impressive, as they'd need their malware to both do what they want and exactly match that hash. Not impossible, just clever.