In some cases the library affected may now instead provide a security risk in itself, which you wouldn't have had you only gone with plain HTTP. This cuts both

In some cases the library affected may now instead provide a security risk in itself, which you wouldn't have had you only gone with plain HTTP. This cuts both ways though - maybe your package parsing and signature verification code has a security flaw in it, in which case you'll find yourself wishing you had the protection of only trying to parse packages from the HTTPS-verified legitimate source. So the answer to the question posed earlier, "...so what value does HTTPS provide in those cases?" is that it avoids have a single point of failure in your security architecture. It's also worth pointing out that most of those protocol-level TLS vulnerabilities mentioned wouldn't have been exploitable in the far more restricted setting of "device that phones home to check for updates".