Personally I'm more against the concept of downloading random Appimages from github.
Unless you've personally gone through the repository code and know that it is clean and safe the hash tells you nothing of importance in that regard. It can be used to verify that the file is complete and didn't corrupt during the download and ensures that no MITM attack went through undetected.

Flatpaks are at least isolated and when you grab a popular package from flathub one can hope there would be an outcry if it's unsafe. AppImages per default get full access to the user /home.

To make binaries trusted, reproducible builds are a thing. People build the same software from source independently and get the same binaries. Then it can be said that the binaries haven't added code missing from the source. It is a difficult goal to achieve because how many complex moving parts are needed to build modern software. Much work relies on distributions' standardized packaging infrastructure. Read more about monthly achievements in this field: https://reproducible-builds.org/

Hash, as anamethatisnt said, is just to confirm nothing's corrupted.

Without knowing how to read code, best you can do is check the issues section, the number of "stars" in the repo (similar to likes), if the AppImage is provided by someone other than the original author (common when the original project doesn't include an AppImage), and other indirect signs.

If you know a bit of troubleshooting, not to be confused with knowing how to code, you could also download the AppImage to a virtual machine, cut all direct communications of the virtual machine to the internet and to the host machine, and unpack the AppImage to see if any files are amiss.

Alternatively, but that also requiring some knowledge of troubleshooting, you could ask a LLM to make an "AppImage recipe" for the program you want and it should explain step by step how to make the needed AppImage. And troubleshooting comes into play because you better check at each step if it isn't hallucinating or linking you to shady sites (latter extremely rare in my experience but better than to trust blindly).