Well, because it's a mechanism the user is not controlling and is potentially problematic if someone makes the plugin download an update package from another so

Well, because it's a mechanism the user is not controlling and is potentially problematic if someone makes the plugin download an update package from another source. I'm a bit paranoid, but I would prefer all functionality to be within the plugin itself. There's a plugin manager for Notepad++ which notifies the user of plugin updates.