In 5+ years of OSS, only once have I even heard of hashes not matching and a build server being compromised, and it was fixed within 30 minutes. It was also a very big deal.
Basically, what you’re saying and what a quick search on Google shows seems to suggest user error.