From the short description in the advisory, would seem like the attacker can cause the tool to overwrite the file after signature verification.

Of course not, Debian is one of the most robust pieces of software around. They wouldn't do something idiotic like relying on the hash being sent with the payload through the same channel.

I think the idea is that debian distributes the hash themselves through their domain, and mirrors offer the downloads either through http or https. So that you don't need to trust the mirror, you just verify the debian given hash. Only weakness would be a hash collision or a cve like this.