1P could be 'compromised' and send a malicious version of their software back before they had the subscription model... I don't see how this is involves any mor

1P could be 'compromised' and send a malicious version of their software back before they had the subscription model... I don't see how this is involves any more risk.