The official site only has md5 sums, which can have collisions easily created, and the official site serves them over HTTP, so the attacker wouldn't even need to create a collision, the attacker could just change the md5 on the page to their malware infected version.
Not being able to verify that the d/l official came from Intel means that it increases the chances that my machine will be infected w/ malware.
Note: if you're a user (not an official Intel rep), posting your hashes only marginally helps. W/o knowing your path and ensuring it is disjoint from mine just means we could be attacked by the same attacker. Best is to get an official statement from an Intel employee as to the hash.
