The internet in China is so bad developers at Tencent download Xcode from random links on Chinese Dropbox? Pathetic.
Data localisation regulations are certainly one reason for foreign companies to set up local infra, but IMHO the real reason is that it's the only way to provide an even remotely tolerable user experience to users in mainland China. Aliyun is basically AWS for China and is very easy to get up and running, and getting an ICP license wasn't nearly as hard as everyone makes it out to be (got one in ~2 weeks from application).
Checksums are useless if you don't have access to an alternative source.
Not true, they have access to original XCode (and checksum), but the download speed is very slow.
Or if the developers never disable GateKeeper and read the warning, they will know that the application is not genuine.