There are ways a user can mitigate this from happening, even when a trusted source gets compromised.

As the saying goes in Crypto, Don't Trust, Verify.

Open source software usually provides a Checksum in their release notes of which users can hash the downloaded software to compare against.

Feel free to start your research with the article we recommend.

https://www.howtogeek.com/363735/what-is-a-checksum-and-why-should-you-care/