based only on the wording in the notice:

> APT can merge two different package downloads after an HTTP redirect gives them the same URI

It sounds like the verification is ran but there is some deduplication or caching involved keyed on the destination of the url redirect, not the original source.

So could imagine a malicious server that:

Responds for a request for foo.deb with a redirect to evil.deb containing the original foo.deb. This validates properly.

Responds with a second request for bar.deb with a redirect again to evil.deb that now returns a malicious package. The downloading code thinks it has already validated evil.deb