Even worse: imagine a poisoned update that gets installed on every browser within the hour. Or just an update with a non-malicious bug that breaks the updating

Even worse: imagine a poisoned update that gets installed on every browser within the hour. Or just an update with a non-malicious bug that breaks the updating mechanism. (This last has happened to companies the size of McAfee and Skype.)