I think so, but I don't think it's actually a correct assumption. The article talks about the list of firmware versions (and where to download them from) as be

I think so, but I don't think it's actually a correct assumption. The article talks about the list of firmware versions (and where to download them from) as being fetched from a JSON file delivered over HTTP. That json file isn't signed in any way, so you could first intercept that, change the links and expected versions, and you're home free.