Unless the download page is hacked and Google picks up a spoofed checksum.

They need to sign their updates as well.

Yeah, and Linux is compromised if someone kidnaps Linus Torvalds family in exchange for creating a backdoor in the Linux kernel.

The security is created by humans to be used by humans; so nothing is truly safe if <insert random circumstance> happens; and anyway, for cases like yours the hack would be found after few days when any of the people in charge of the compiling realizes that the check-sum is spoofed and would advice anyone to update the OS after the issues is taken care of.

Unless the malware is spread by Google.

... or, more likely, the MITM is capable of spoofing selected google searches as well.

You know Google always uses ssl right?

There are people in the world capable of spoofing SSL one way or another (forged certs, suborned CAs, etc.), though it certainly does raise the bar past the script kiddie level.