I agree it's only a modest infoleak. Depending on the nature of the exploit you may not have multiple attempts. Consider also that one can block updates by serv

I agree it's only a modest infoleak. Depending on the nature of the exploit you may not have multiple attempts. Consider also that one can block updates by serving the client stale update lists/packages. The client sees "no updates available" and thus the attacker can extend a window of vulnerability. Using TLS on the update delivery mirrors raises the bar.