WinSCP downloads are (currently only partially) hosted on SourceForce since 2003:
https://winscp.net/eng/docs/project_history#sourceforge
They have never ever altered our downloads.
I know that in the past, they did wrap the original installers in their own ad-supported installer. But I believe they did that only with approval of the respective project owner (like they did with FileZilla for instance). And that was years ago. SourceForge is now run by a different company that stopped this practice.
Note that most WinSCP downloads are served from our own servers. SourceForge hosting is used in some cases only. But it does not matter. Your downloads are safe.