It is very common to download the binary from a source that is "closer" (in the network topology) to you, but use a "trusted" source (i.e. the vendor's web server) to obtain the signature / checksum.
That's why they are separate.
Now, your last question is valid:
in case the site has been hacked to point the download link of the exe to a malicious file? In that case, won't the links to the signature/public-key themselves be altered by the attacker?
Yes, if an attacker gains control of the content of the site, then she can replace both the binary and the signature. But, that is not what this kind of signature protects against. It is supposed to allow you to verify the binary if you get it from some other source than the official website. (It can also be used to guard against corruption of the download, of course.)
If you want to protect against the scenario in your question, then you need a way to obtain the signature via a separate trusted out-of-band channel.
E.g. in my university, the fingerprint of the master certificate and the PGP key were printed in the handout you received when you signed up for your university account, and were also printed in the copy of the student handbook and displayed at the computing center help desk as well as printed in the university newspaper.