The goal of a MDC is to provide integrity guarantees. That is, given the value $h(x)$, it should be possible to check whether $x$ has been tampered with. The attack scenario you are describing requires authenticity guarantees, i.e., you want to be able to detect whether the tuple is actually from Alice. To achieve this, there are many possible solutions. One simple example would be to require an additional signature from Alice on the tuple (this is for the setting where Bob will need to verify the authenticity and the integrity of the tuple). In case you only require private verification, i.e., Alice stores the data somewhere and when retrieving them again wants to verify authenticity and integrity, you could simply use a message authentication code (MAC).
To your question: in many practical scenarios the hash is delivered by some other means. Yet, in many cases you also have no (cryptographic) authenticity guarantees. Take, for example, the hashes which are provided when you download files. In case you are using plain HTTP you also only can verify whether the downloaded file fits the hash, but you can not verify whether the page you are viewing is actually the page it should be.