Are there any known software updaters that rely only on Secure Transport hostname checking for update authenticiity? If you use NSS-based browsers exclusively

Are there any known software updaters that rely only on Secure Transport hostname checking for update authenticiity? If you use NSS-based browsers exclusively on OS X, can you have been pwned via fake updates due to this bug?