preauth RCE in the biggest web software in the world + private key leaked that was trusted by basically every device = internet is on free roam sandbox mode this week
i don't entirely know how much i believe this specifically but i do think that checking hashes and verifying signatures simply involves too much friction and/or effort for people to bother, compared to the effort of downloading something for example