Update checks are usually implemented as soft-fail, i.e. failing to connect to the update server won't result in a notification, unless it's an active update ch

Update checks are usually implemented as soft-fail, i.e. failing to connect to the update server won't result in a notification, unless it's an active update check performed by the user. HTTPS alone wouldn't fix this scenario, you'd have to either do hard-fail (which could become annoying and cause users to turn off the update check) or have some sort of grace period and only nag after a couple of failed attempts or a certain amount of time, which still leaves users vulnerable for a time.