A hash function produces a short fingerprint of a file. If even one byte differs, the fingerprint differs. Checking it can detect corruption, a tampered download or modified application files.
The check is only as trustworthy as the reference. If an attacker controls both the file and the published checksum, the comparison proves nothing, so the reference should come from a separate, trusted channel such as the official project site over HTTPS.
A match shows that the file is identical to the reference, not that the software is secure or up to date. Use verification together with version checks and vendor advisories.