Because zypper downloads it from mirrors while redirectors are configured to return metadata directly, without redirecting to mirrors: Yast checksum update problem - #16 by arvidjaar
All these "me too"s are pretty useless without also showing what mirror returns the bad data. As I have shown in the linked post, you can force zypper to download metadata directly. But of course if metadata is corrupted, there is no guarantee that packages themselves are not corrupted. OTOH zypper is using different engine to download packages, which may be more resilient.