If the code url and hash are provided at the same place, why wouldn't an attacker just MitM that and switch them both? What does this add?

Also anyone who is not serving code over https should fix that immediately.