The `hash` utility will return true if the given utility is found in `$PATH` after doing a path search for it.
Since you give the name of the utility with a path, the shell would _not_ do a path search for it, but instead use the path that you provided (`./`). It's not until the shell actually tries to _run_ the utility at that path that it discovers that it doesn't exist.
The POSIX specification for `hash` says
> If utility contains one or more `
... and `bash` obviously implements the unspecified behaviour as "if no path search needs to happen to find the utility, return a zero exit status".