What is the point of comparing sha256 of downloaded file with published on the same website code?
Nothing. It is mostly only useful for checking data integrity, not detecting malicious modification (unless you know someone trustworthy that signed the hash). SSL has the same problems though, because public keys can be altered too of course.

There are multiple solutions to this problem, although none is perfect.


Trusting some central authority to decide who is trustworthy and who is not (i.e. Certificate authority). This approach has been shown multiple times to be dangerous, see DigiNotar for example. 
Building a web-of-trust, the method PGP (and later GPG) implemented.
Circumventing the normal network with private lines and routing (the military approach), or wait for quantum encryption to become available.