In the past numerous file distribution servers were attacked and the attacker replaced a release tarball/zip with a modificated version including a backdoor. Usually the distributions use some kind of signatures to avoid such an attack against their own infrastructure but this doesn't include the initial retrieval of the source code from upstream (usually done through the tarballs).

After the decision to remove linux-modules-extra-2.6 from Debian, it is now time to move all modules to a new method for compilation. Nothing is bad about module-assistant - beside the problem that you must know about it and understand how to use it.