The point is not that pulling any project from the asset store is insecure. It is for any code you download onto your computer that can execute arbitrary code. (In fact, yeah, the asset store itself could be dangerous, as it encourages people to download a package without first being able to inspect it. Again, I personally prefer pulling from a repo, which I can check out beforehand.)

The point is that a bad actor might be able to put themselves between your repository and the exact package version you're attempting to download, and give you something you did not expect. The checksum helps ensure that what you're getting was not tampered with, whether it by a man-in-the-middle, a hacker of the asset store, a hacker of the asset owner's account, or a malicious asset owner.

OP accepted the feedback, but they appeared to be.. let's say "more emotional" than others in this thread.

But hey, I appreciate you looking out for OP. They don't deserve to be piled on. I'm just trying to explain why I said what I said.