On second thought, Qubes OS does not prevent such types of malicious downloads; it can also happen to Qubes images. Verify your downloads with checksums and cryptographic signatures [1].

[1] https://doc.qubes-os.org/en/latest/project-security/verifyin...