You're correct though in that just randomly picking mirrors is a bad idea. I seriously doubt your average person is utilizing checksums.
Sure, if you're utilizing checksums the way they should be then go ahead. But honestly, even I don't care that much - my ad-heuristic was sufficient so far :). I should probably start using them. I guess it's like with all things crypto - the UX sucks so bad that most people don't bother.
Well...it would take a particularly craft individual and far too much time, but spoofing a malicious MD5 checksum should be considered plausible. The chances of it being malicious, however, are drastically reduced to such a large degree as that it is safe to consider it negligible. (Note: I only make this claim about MD5 checksums, not SHA-1 or SHA-2. I do not consider MD5 secure in any manner and my trust of SHA-1/SHA-2 isn't exactly high either.)
I provide SHA-1 and MD5 checksums of any software I distribute - if only because I think it is the proper thing to do. Even if most people don't bother checking them (let alone know how to check them)
http://www.codeproject.com/Articles/11643/Exploiting-MD5-col...