My gut tells me it’s easier to sabotage something passively polling for updates vs something built into the OS that checks at each application launch, but if no

My gut tells me it’s easier to sabotage something passively polling for updates vs something built into the OS that checks at each application launch, but if not, the only difference is the vulnerable window between polling intervals. So, you may be right, may not make much difference. I don’t accept malicious data-mining intent, however.