Instead of replacing the md5sum on the download page an attacker could replace the infohash/magnet link/.torrent file.