To be honest that problem exists for essentially any software that auto-updates. You just have to hope that the built-in integrity checking (if any) works and

To be honest that problem exists for essentially any software that auto-updates. You just have to hope that the built-in integrity checking (if any) works and is effective. That's why I like software distribution methodologies that rely purely on signing to verify authenticity, rather than simply the location that it was downloaded from. I can technically use any old dodgy Apt mirror that I want, as long as I only accept packages signed by trusted keys. As a side note, it's shocking how many software providers say that their downloads are 'integrity checked' just because they're served over HTTPS.