> It appears that the hacker did not update the MD5 present in the automatic update mechanism. (Sparkle) Thus, when the automatic update mechanism downloaded the hacked version of Transmission, it reported it as a corrupted download

yeah. But not knowing how the attacker got access, we have no idea whether they have changed the current 2.92 binary again, this time remembering to update the hash in the appcast or whether this time around the binary is actually pristine.

The fact that the site was never down between this happening and the red warning text appearing makes me suspect that only a hasty cleanup was performed and that the actual security flaw might still exist.