Whether the file is on mediafireMediaFire or xdaXDA, you still run the risk of a user putting up a bad file (whether maliciously or incompetently). You have to trust someone unless you decide to make your own romROM from scratch.
You could always open the update.zipupdate.zip
file and do a cursory look at its contents. And if the poster has a good history, that gives points in their favor. Many posters on xdaXDA host their files on external download tools like mediafire;MediaFire; it doesn't inherently make the file more suspicious.