You got the same download as you'd get from Audacity itself. SourceForge is acting as a mirror. Unfortunately, the Audacity installers are not digitally signed, but they are bit-for-bit identical on the SourceForge download to the Audacity website download.

SourceForge never modified installers of projects. Even of ones like FileZilla participating in the program. They push "download offer installers". So, if you try to download FileZilla, you get a 750K download that shows you offers when run and downloads the actual FileZilla installer in the background and runs that after you accept or decline the offers.