SHA-256 is a cryptographic hash function that reduces any input to a 256-bit fingerprint. It is deterministic, so the same input always yields the same output, and it is infeasible to find two different inputs producing the same fingerprint.
In source control that second property is what matters. If a file's SHA-256 matches what was recorded when it was uploaded, the content is byte-identical. Not probably identical, identical.
USourceControl computes a SHA-256 for every file on upload and verifies it on download. Transfers of multi-gigabyte assets over consumer connections do occasionally corrupt, and silent corruption is worse than a failed transfer: a subtly broken texture gets debugged as an art bug for a day before anyone suspects the file itself.
The same hashes drive incremental sync. Comparing fingerprints is how the client decides what actually changed, which is why an unchanged 4 GB asset costs nothing to sync.