It's needed to provide checksums for each module. It also significantly improves performance and prevents a left-pad situation.
Maybe I'm missing something, but this whole operation feels like a huge infrastructure paid by Google for something that is not needed.
Git uses SHA1 which is pretty far from cryptographically secure. It’s unlikely that’s the sole reason for having a separate checksum database though.
As sibling comment notes, Git's hashes are not secure: https://shattered.it