That's what I would expect. Would you expect that if you overwrite a package-provided binary (eg. /bin/ls) with another version, that they'd be able to tell th

That's what I would expect. Would you expect that if you overwrite a package-provided binary (eg. /bin/ls) with another version, that they'd be able to tell that? Knowing if packaged version is vulnerable is a good first step.