Unless the dependencies they compile in have reproducible builds set up, then you literally cannot expect binaries to compile the same bit-for-bit between different build environments. This is a known problem for tons of reasons, etc etc. Progress has been made on improving build practices, but there are still tons of projects that aren't reproducible. Also, the checksums not matching could easily be caused by Ventoy developers enabling different compile-time flags on their builds than upstream builds, which is near the top of the list of reasons why you'd bother to provide your own builds to start with. There are literally like 500 legitimate reasons why their builds might have different checksums than upstream's builds. Your accusation is nonsense unless you can do some more digging and prove there are unpublished modifications to their dependencies.