Git tries hard to get convinced from the lstat() value alone that the worktree matches the index, because falling back on file contents is very expensive.
Documentation/technical/racy-git.txt describes what stat fields are used, and how some race conditions due to low mtime granularity are avoided. This article has some more detail.
stat values aren’t tamper-proof, see futimens(3). Git may be fooled into missing a change to a file; that does not compromise the integrity of content-hashing.