Well that's a matter of trust as well, isn't it? I would assume that even if it's user configurable, the app itself should still ship with an up to date catalog

Well that's a matter of trust as well, isn't it? I would assume that even if it's user configurable, the app itself should still ship with an up to date catalogue whenever a new release is made. After all you're already trusting the app itself at that point.