Checksums can only verify that the size of the received item and the requested item are the same, so a crafty person could modify their distribution with packed viruses or other nasties.
Checksums/hashes work on the data itself, not just the size of it. If steam sends you send a secure hash of each block, no matter what a malicious person tries to do, they can't make the secure hash the same as it was before, so they can't infect your download.
