Yeah. Just how it goes unfortunately. Consumer buy-in is vastly underrepresented in the technology world. Google, Facebook, Twitter, etc have all leveraged customer and community laziness to push the boundaries without much blowback. If Elon’s tenure over twitter/xitter shows anything, it’s that.
A pre-registered checksum will ensure that the downloaded file is what it says it is before running. So yes, it is safe. Unless you’ve found a collision in the checksum algorithm apple is using, although the chances are better that you’ll squeeze water out of dry desert sand.