Right now I think that we only should update the remote zip package if the sha1 change.
For remote zip packages the sha1 change only if the teacher/admin updates the resource and point to a different URL.

The reason to not update the package using the frequency indicated in the module settings is that there is a bug MDL-52459 open that prevent the remote package to be updated. In this scenario, if we update the package the zip package in the app and the imsmanifest.xml has changed, we will be displaying an invalid TOC (because we read the TOC from the site where probably is the old package and not from the package).

In any case, we need to keep this issue open until MDL-52459 is solved to make a final decission.