Different people build the Tor Browser Bundles on Gitian (look it up), and they will have the same hashes. So unless ALL of these people are lying, if their hashes match, you can be convinced that it is the same binary as you would get by compiling it.
a). For all the bundles, they are signed by the Tor developer who packages them. The signatures are clearly visible with the downloads.
b). Most importantly:
Tor is moving towards deterministic builds: https://blog.torproject.org/blog/deterministic-builds-part-o...
Different people build the Tor Browser Bundles on Gitian (look it up), and they will have the same hashes. So unless ALL of these people are lying, if their hashes match, you can be convinced that it is the same binary as you would get by compiling it.