You already trust them not to make compromised software updates anyway. While I agree that this is definitely a potential issue, I don’t think it changes the th

You already trust them not to make compromised software updates anyway. While I agree that this is definitely a potential issue, I don’t think it changes the threat model.