The argument isn’t correct, what does a user do when the download is damaged by an injection? A re-download results in exactly the same tampered with file.