And yet on Linux the advice seems to be never ever download directly from the developer

That's just advice for making life easy for new people, because distro-packaged software is more likely to work well with the operating system. I run packages from devs, even nightly automated builds of stuff, all the time.