(this includes blocks mined by rich list list #12 and #9, so if it's a fork, they would be on it as well)
Technically speaking, the file is not provided by the team, but by a link to a mediafire url.
The trust issue is not about the dev team, but about whether the data you get may or may not actually be from the dev team
The github source code is trustable, as it is hosted on an https server, with a well identified url and a list of recent changes/commit and git's own tamper-proof hashing, so any hijacking attempt would not go unnoticed, but the mediafire link on the other hand is "meaningless", http, and the data itself hosted by a 3rd party. This is vulnerable to several vectors of attack.
When replacing the db, the wallet will only check the last 2500 blocks, while when using a bootstrap.dat, the wallet will check the whole blockchain, making hijacking attempts as hard as a full-scale 51% attack, so it's okay to host the bootstrap.dat anywhere.
The blockchain download will be coming off the website once we sort out our issues, bootstraps will take the place. I hated having to put the full db up because it isn't how crypto was meant to flow, but it's what worked at the time. We were dev-less, and I had to do what I had to do to keep the chain alive in my position. I've stated I attempted to make bootstraps in the past, they didn't work out. We have bootstrap capabilities now, so downloading those from mediafire shouldn't be an issue as you stated.