There are two reasons you want to compromise a host: 1) You're building a botnet (or, these days, are crypto mining). In that case you're not targeting a speci

There are two reasons you want to compromise a host: 1) You're building a botnet (or, these days, are crypto mining). In that case you're not targeting a specific machine, you just want many of them. 2) You want to exfiltrate information from a host, or sabotage it. In that case you're targeting a specific machine. I'd argue that in both cases, the proposed attack vector of inferring installed software versions through apt downloads is inferior, or at least more involved. In case 1) you're better off scanning for known vulnerabilities or make use of shodan and the likes. In case 2) you're probably going to probe the server anyways. It might take a little more time than if you just had a complete list of installed packages and their version (given you were somehow able to eavesdrop on the host in the first place), but you'll most likely determine at least what OS is running and what technology stack their internet-facing services are running on after some nmapping. Or, looking at it from the other perspective, I wouldn't really feel much safer if apt were using https. I'm not against it, but I don't think it's a priority, especially if it needs a lot of coordination between different people, which always turns out to be very time consuming. Just being fast with updating packages seems a better investment of that time.